Sharing Session object between different web applications

Question

Okay this is the problem

I have a Java application running on top of Apache Tomcat & I have this other application too with its own war file running on the same server.

Now I want to authenticate user once & pass that session to the other application.

We can say cross domain session sharing on same Apache Tomcat .. how should I go about it ....?

Thank you

Answer 1

Tomcat provides Single Sign On functionality via a valve specified within Host element in Tomcat's configuration:

<Host name="localhost" ...>
  <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
</Host>

There are certain restrictions applied, take a look at the above link (scroll to Single Sign On section) for details.

Answer 2

Create a unique token for the session and put in in a db table that both apps access.
Store the token in the users's cookie.
This avoids the session sharing issue and is also more scalable.