You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by "kairosci (via GitHub)" <gi...@apache.org> on 2025/09/06 15:33:44 UTC

[PR] feat: Make SSO re-authentication configurable for SSLAuthenticator [tomcat]

kairosci opened a new pull request, #890:
URL: https://github.com/apache/tomcat/pull/890

     This pull request introduces a new boolean attribute, allowSsoReauthentication, to provide control over the SSO re-authentication behavior in the SSLAuthenticator.
   
   ## Description
   
     The changes include:
      * Adding the allowSsoReauthentication attribute to AuthenticatorBase, along with its corresponding getter and setter methods.
      * Updating SSLAuthenticator to use the value of allowSsoReauthentication when checking for a cached authentication, allowing it to proceed with re-authentication if enabled.
      * Exposing the allowSsoReauthentication attribute in the MBean descriptor for AuthenticatorBase and SSLAuthenticator, making it configurable at runtime.
   
     By defaulting to false, the existing secure behavior is maintained, while providing administrators the option to enable it when their security requirements permit.
   
   ## Motivation
   
     The SSLAuthenticator is designed to enforce a higher level of security by requiring client certificate authentication. As part of this, it currently prevents re-authentication from an existing Single
     Sign-On (SSO) session that may have been established using a weaker authentication method (e.g., FORM or BASIC).
   
     While this is a secure default, it is not currently configurable. There are use cases where an administrator may want to allow re-authentication from an SSO session, even if the original authentication
     was weaker, to provide a more seamless user experience. This change introduces the necessary flexibility to support such scenarios.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

Re: [PR] feat: Make SSO re-authentication configurable for SSLAuthenticator [tomcat]

Posted by "kairosci (via GitHub)" <gi...@apache.org>.
kairosci closed pull request #890: feat: Make SSO re-authentication configurable for SSLAuthenticator
URL: https://github.com/apache/tomcat/pull/890


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

Re: [PR] feat: Make SSO re-authentication configurable for SSLAuthenticator [tomcat]

Posted by "michael-o (via GitHub)" <gi...@apache.org>.
michael-o commented on PR #890:
URL: https://github.com/apache/tomcat/pull/890#issuecomment-3262558459

   How is this expected to work when you can configure client cert auth per virtual host only and not per resource? The flexibility from HTTPd does not exist here...


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

Re: [PR] feat: Make SSO re-authentication configurable for SSLAuthenticator [tomcat]

Posted by "kairosci (via GitHub)" <gi...@apache.org>.
kairosci commented on PR #890:
URL: https://github.com/apache/tomcat/pull/890#issuecomment-3262594771

   Client certificate authentication is currently enforced by Tomcat at the virtual host level rather than per resource.  
   Because of this restriction, the SSLAuthenticator usually applies consistently to every request made by the host.
   
   Administrators may, however, set up several authenticators (such as FORM and SSLAuthenticator) on various virtual hosts or during transitional stages in certain deployments.
   The `allowSsoReauthentication` flag provides flexibility in such hybrid setups, allowing re-authentication from an existing SSO session when appropriate.
   
   This modification foresees future extensibility or custom implementations where finer control may be introduced, even though the current architecture does not support per-resource granularity.
   Additionally, it makes the behavior more transparent and configurable by helping to isolate and clarify the logic surrounding SSO re-authentication.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org