title: Emulate and/or Enable Single Sign On in Tomcat using AJP
body: <p>I have apache forwarding requests to tomcat using ajp. My app in tomcat uses basic authentication via tomcat-users user database.  Users are listed there, given roles, and everything works great.</p>
  
  <p>However, my users have id cards they plug into their workstations which identify them by a unique number.  I don't know the details of this, but apache and the browser has some module(s) which automatically identifies the user and essentially authenticates her and REMOTE_USER is available when in the apache environment.</p>
  
  <p>Unfortunately, REMOTE_USER isn't available in tomcat (via the request.getRemoteUser()), so the user is prompted to log in when going to my tomcat app. I found this thread:</p>
  
  <p><a href="https://stackoverflow.com/questions/13749065/forward-remote-user-to-tomcat-via-ajp-e-g-for-shibboleth">Forward REMOTE_USER to tomcat via AJP (e.g. for shibboleth)</a></p>
  
  <p>Which describes that you can disable tomcat authentication, which makes the REMOTE_USER available in tomcat, but since we've disabled the tomcat authentication, there are no longer any roles assigned to the user.</p>
  
  <p>To be clear, I've added this id number to the tomcat-users but it doesn't help:</p>
  
  <pre><code>&lt;user username="billg" password="pass" roles="ceo"/&gt;
  &lt;!-- billg's id number --&gt;
  &lt;user username="12345@ms" roles="ceo"/&gt;
  </code></pre>
  
  <p>I know this is a somewhat unique environment and request, but does anyone have experience with making something like this work?</p>
  
  <p>FWIW: This is apache 2.2+ and tomcat 6 (but if there's a solution for tomcat 7+ I'm interested in that as well).</p>
  
  <p>Thanks!</p>