HTTP-server, Websphere, security

Hello everybody,


We have an application, which is comopsed of html and jsp-pages. The pages are
served by IBM HTTP-server and Websphere Application Server 3.5. Both are running
on the same AS400, which also stores the html and JSP-pages.

The acces to the application is controled by the document-protection in the
HTTP-server.

We have 2 AS400: a development and a production machine.

On the development machine, everything works fine: the user must to enter his
name and password to have access to the pages. His access is checked according
to the protection setup in the HTTP-server.

But on the production machine you can access the pages without entering a
password. Apearently, the setting on both machines are the same.

As I understand the documentations, the Websphere also has security settings,
but we don't use them.

As both the HTTP-server and the websphere can serve html-pages (jsp-pages can
only be served by by the websphere) I stopped the websphere server. Then the
password was asked correctly.

Having websphere running again, the password wasn't asked anymore. It seems,
that, for some reason, the security treatment is done prior by websphere. (on
the production machine, but not on the development machine)

Has anyone an idea where the source of the problem is? Where can I find
documentation describing the interferance between HTTP-server and Websphere? I
only found documentation about either HTTP-server or Websphere, but nothing
about the link of the two.

Thanks in advance,

     Marc Nothum