How to connect Tomcat 9/10 to Active Directory and login through SSO to and app

Hey there 👋

A few quick suggestions that might help:

1. As far as I know, SPNEGO/WAFFLE is still your best bet for SSO with Tomcat + Active Directory, but it’s very sensitive to Java version compatibility and proper Kerberos/SPNEGO setup.

2. Java 11+ sometimes causes issues with WAFFLE, so if possible, test with Java 8 just to validate your setup works end-to-end first — even if it’s not your final goal. Once it’s working, try upgrading gradually.

3. Make sure your AD DNS and time sync are correct — Kerberos will silently fail if there’s even slight clock drift or DNS resolution issues.

4. Double-check your SPN and krb5.conf (or Windows registry if you’re using native config) — this is often where things go wrong. Also verify the waffle.tomcat filter is applied correctly in web.xml.

5. Here’s a good example guide worth revisiting: 👉 https://github.com/Waffle/waffle/blob/master/Docs/tomcat/TomcatSingleSignOnValve.md

6. If you’re stuck, consider testing with a basic WAFFLE demo app first, outside of your main application, just to confirm the AD integration is actually working before adding complexity.

- Bobby