I think the reason is obvious. My server (running Jetty) is offering
different services for different groups of people. Some services need
to be restricted to, say institutional subnets or similar. And for
this, the firewall is definetely not a good solution.
For this, a suitable user login and authentication mechanism is a good
solution. I assume this is for your LAN or a VPN-tunnel-based WAN, in
which case, stick it behind the corporate firewall and use password-
based authentication. What if an authorized person wants to access
this service from other than his usual location for whatever reason --
or an unauthorized person gets physical access to one of the machines
you'd be whitelisting?
Also ask what the purpose of the access restrictions is. If it's for
crass commercial reasons then I won't be very sympathetic, although if
it's to keep confidential information confidential, like patient
records or financial data or credit-card numbers or what-have-you,
then it's another story. It may be the case that the restrictions are
gratuitous or unnecessary to carrying out your primary purpose and
will just inconvenience or cost people needlessly (e.g. if it costs
very little in resources per access and organization-wide access would
do no harm and might benefit some people, but it's going to be
restricted to a subset of the organization, or people will have to pay
for access). If the restrictions are absolutely necessary,
particularly for security of confidential data or trade secrets or
something, though, figure out who needs access and set up a system
with user or group accounts and passwords.
