title: Multiple web apps security demystification
body: <p>I am deploying two web apps on a single jboss as7 instance.  One app is spring/maven based and uses spring security for authentication.  The other app is a birt web app that doesn't require direct login authentication.  The two apps are joined by a single menu link that is only displayed when the logged in user possesses a management role.  So the spring app is the main app and it provides a link to a birt web app, if the user is a manager.  My problem is that the spring app is secure (no direct url access, user required to login, etc) but the birt app can be accessed without logging in if someone is aware of the app's url.  I don't want to have two separate login pages.  I want the spring app authentication to also determine access to the birt app, but I'm not clear on how to do this.  I added a security constraint to my birt app's web.xml file and a jboss-web.xml file to establish the security domain for the app.  The security constraint does not make a difference whether it's there or not, but the security domain does restrict access to the birt app via url.  So what is the next step from here?  How do I grab the authentication from the spring app (jsessionid?) and use it to permit a user access to the security domain that contains the birt app?</p>
  
  <p>Both apps are on the same domain...e.g "domain/springApp or domain/birtApp" if anyone was wondering. </p>