We do not use GeoServer Authentication, but we do use an ASP version of that Proxy Script we wrote ourselves with some tweaks.
Our script handles the authentication via a Hashtag we included in the WMS Client Calls.
The HashTag is set into a database at the Application Level User Login and removed at LogOut or Timeout. It is sent to the client via Ajax at Client logIn Time as well.
The Hashtag is used only once and is not repeated again for x amount of days. (we use one year)
We use a url format as follows (asp)
http://maps4.markware.net/?" & HashTag & ":-:" & LAYERS=
and parse out the hash between the ? and the :-: in the proxy script, check the tag is valid then rebuild the string to a new valid url pointing to the Geoserver instance.
Of course, you have to handle the return posts from Geoserver and forward back to the client, the script you mentioned handles that.
If your Geoserver Instance is behind the proxy and only accessible via a local lan, then this is all you need, It is secure. If not, you need to set up a firewall rule on the Geoserver machine that only allows port 8080 from your proxy Ip Address.
This way, we do not have to keep track of hosts and we handle authentication at the Application Level. Invalid or no hash tag, no tiles.
We later enhanced our script to load balance over multiple GeoServer Instances and forward some requests to GeoWebCache and some to GeoServer depending on the application requirements. It does give you a great deal of control over your setup!
Best Answer
The best bet is to have GeoServer behind your web server. This way your requests are received by web server (IIS) first where you authenticate user and then allow features based on roles.
While there are GeoServer Authentication options and GeoPrisma, I think for 90% of apps could use this proxy approach and retain all Geo/Map data securely behind a firewall.
Cheers,
Ramesh