A generous contributor (Nicolas Guillaumin, @nguillaumin who works for a company called Funnelback), has committed the much requested impersonation support to Waffle. This is pretty exciting, since it fills in a bunch of squares in the puzzle that we’re trying to assemble with the Waffle project.
I tried it out with build 1.4.1744.0.
First, there’s a line of code in the index.jsp that displays the current Windows thread identity by calling a Win32 API via JNA.
I have two users, dblock-gray\dblock and dblock-gray\test. I am running the Tomcat server as dblock-gray\dblock _and am browsing to it logged in as _dblock-gray\test. Without impersonation I see the following.
This means that while I am logged in as the test user (
request.getRemoteUser() returns dblock-gray\test), the Windows thread identity is the same one as of the Tomcat server (dblock-gray\dblock).
Let’s add impersonate into web.xml.
Tomcat now impersonates dblock-gray\test.
This is great news: I can now operate on behalf of dblock-gray\test to, for example, access files that test owns on the server. Also note that this is the default behavior of IIS when you enable Windows Authentication and we’re now accomplishing the same with Tomcat or any other servlet-compliant server.