We have a very old app (Still on Java 1.4 and Tomcat 4.1, don't ask) with custom built authorisation and authentication and just about everything else. We plugged in DBCP to replace the custom built (buggy) connection manager just the other week, but I digress.

I have decided that we'll use the latest version of Pebble and further that I will only attempt to integrate with Tomcat 6 and Java 6. It is just too hard otherwise.

I'll be looking at having both apps in a single Tomcat container and using the Single Sign On Valve to communicate authentication between the two applications.

Our app will be the master, and after authentication it will talk directly to the Tomcat Realm to pass a shared Principal class instance, as I'm hoping the shared class will avoid me needing to do reflection things

The hope is that our app writes the Principal instance, which will be available in Pebble, and then Pebble can then cast and use the data to perform its own authentication, but honestly it will just pull the name and ensure they have the correct role. Wish me luck, I'm going in...