Geek asks and answers

Request client certificate authentication for a specific resource only

I am deploying webapp on Tomcat, which will eventually become a platform offering several services. Sometimes I need to be able to authenticate a user with client certificates, but only when she visits some servlet / URL to verify the certificate and read some attributes.

I came to the conclusion that only with Tomcat and jsp / servlets it is impossible to make only part of the web application to request authentication of the client certificate. This is either the entire tomcat server that requests user certificates every time everywhere (clientAuth true or want), or web.xml authorization parameters that are not suitable for this scenario.

Is there any infrastructure, application server, or some specific proven architecture that I can use to achieve this request? I thought I might have a separate server instance dedicated to mutual ssl authentication, redirecting user settings and session forwarding, but this option seems rather complicated to manage. I am sure there are similar solutions, just wondering if there is any reference implementation, recommendations, whatever ... Thank you.

+3
source share
2 answers

You cannot do this only with Tomcat. Client authentication is performed at best for webapp, or you can set it for the entire container in the server.xml element Connector, no matter what it is.

, , Apache HTTPD SSL. ( Tomcat, Tomcat Servlet , webapps.) SSL . , .

+1

Tomcat, . , Tomcat, :

  • : , clientAuth="false". Tomcat:

    "", , SSL , . , , SSL , , . false ( ) , , , CLIENT-CERT.

  • web.xml - :

    <web-app>
    <display-name>My Webapp</display-name>
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>App</web-resource-name>
            <url-pattern>/</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>cert</role-name>
        </auth-constraint>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>

    <login-config>
        <auth-method>CLIENT-CERT</auth-method>
    </login-config>

    <security-role>
        <role-name>cert</role-name>
    </security-role>
</web-app>

    , web-resource-collection URL, .

+5

More articles:


All Articles