You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Gary Briggs <ch...@icculus.org> on 2014/02/07 07:32:47 UTC
SSL with Form Fallback on Tomcat 7 or 8
Evening,
I've been reading this page: http://wiki.apache.org/tomcat/SSLWithFORMFallback
I'm currently using Tomcat 7 on Linux. In short, Neither of the bits
of code linked on that page work for me but the thing described in the
title is what I desire.
I have client certificate authentication working fully within my needs,
but I'm looking for a fallback so I can support allow users without one of
the appropriate smart cards being able to get in. BasicAuth would also
be fine for this project, although I'd much rather it were a form.
Additionally, I'm unclear on what the purpose of "optional" is on the
clientAuth parameter of a Connector,if it's not for the purpose of
some other fallback authentication mechanism to work. Maybe it's just
implemented because it's integral to the TLS implementation?
Another option is to configure the trust store appropriately, then
self-sign certificates and pass them out. That's still a little hostile
to the users that don't have smartcards in the first place; I have my
Realm hitting up an LDAP server with a username-pass tuple that
non-smartcard-wielding users already have an account on.
Any suggestions or direction would be greatly appreciated; fundamentally,
I have an app, using container security to keep it safe. Most users
will use smartcards to secure a client cert TLS, but not all users have
those smartcards.
Cheers,
Gary
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL with Form Fallback on Tomcat 7 or 8
Posted by Gary Briggs <ch...@icculus.org>.
On Sat, Feb 08, 2014 at 06:55:26PM +0000, Mark Thomas wrote:
> On 08/02/2014 18:45, Gary Briggs wrote:
> > On Sat, Feb 08, 2014 at 06:43:42PM +0000, Mark Thomas wrote:
> >> On 08/02/2014 17:29, Gary Briggs wrote:
<snip />
> Done.
Done [added page SSLWithFORMFallback7 and link]:
https://wiki.apache.org/tomcat/SSLWithFORMFallback
Cheers,
Gary
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL with Form Fallback on Tomcat 7 or 8
Posted by Mark Thomas <ma...@apache.org>.
On 08/02/2014 18:45, Gary Briggs wrote:
> On Sat, Feb 08, 2014 at 06:43:42PM +0000, Mark Thomas wrote:
>> On 08/02/2014 17:29, Gary Briggs wrote:
<snip/>
>>> I'm trying to edit the wiki to add my new one, but apparently those
>>> pages are immutable?
>>
>> You need to be added to the list of contributors before you can edit it.
>> Annoying I know, but it is the only spam prevention method that actually
>> works.
>
> Hey, spam prevention is good. One extra email is preferable to the alternatives.
>
>> Let us know your wiki ID and one of the admins will get you added.
>
> GaryBriggs
Done.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL with Form Fallback on Tomcat 7 or 8
Posted by Gary Briggs <ch...@icculus.org>.
On Sat, Feb 08, 2014 at 06:43:42PM +0000, Mark Thomas wrote:
> On 08/02/2014 17:29, Gary Briggs wrote:
> > On Fri, Feb 07, 2014 at 11:02:35AM +0000, Mark Thomas wrote:
> >> On 07/02/2014 06:32, Gary Briggs wrote:
> >>> Evening,
> >>>
> >>> I've been reading this page: http://wiki.apache.org/tomcat/SSLWithFORMFallback
> >>> I'm currently using Tomcat 7 on Linux. In short, Neither of the bits
> >>> of code linked on that page work for me but the thing described in the
> >>> title is what I desire.
> >>
> >> Define what you mean by doesn't work. Also, explain what you did to test it.
> >
> > Fair enough. Sorry, I should have done that in the first place.
> >
> > ... and now, having just spent and hour reimplementing from scratch and
> > documenting for this email, it's working just fine.
> >
> > I'm trying to edit the wiki to add my new one, but apparently those
> > pages are immutable?
>
> You need to be added to the list of contributors before you can edit it.
> Annoying I know, but it is the only spam prevention method that actually
> works.
Hey, spam prevention is good. One extra email is preferable to the alternatives.
> Let us know your wiki ID and one of the admins will get you added.
GaryBriggs
Cheers,
Gary
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL with Form Fallback on Tomcat 7 or 8
Posted by Mark Thomas <ma...@apache.org>.
On 08/02/2014 17:29, Gary Briggs wrote:
> On Fri, Feb 07, 2014 at 11:02:35AM +0000, Mark Thomas wrote:
>> On 07/02/2014 06:32, Gary Briggs wrote:
>>> Evening,
>>>
>>> I've been reading this page: http://wiki.apache.org/tomcat/SSLWithFORMFallback
>>> I'm currently using Tomcat 7 on Linux. In short, Neither of the bits
>>> of code linked on that page work for me but the thing described in the
>>> title is what I desire.
>>
>> Define what you mean by doesn't work. Also, explain what you did to test it.
>
> Fair enough. Sorry, I should have done that in the first place.
>
> ... and now, having just spent and hour reimplementing from scratch and
> documenting for this email, it's working just fine.
>
> I'm trying to edit the wiki to add my new one, but apparently those
> pages are immutable?
You need to be added to the list of contributors before you can edit it.
Annoying I know, but it is the only spam prevention method that actually
works.
Let us know your wiki ID and one of the admins will get you added.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL with Form Fallback on Tomcat 7 or 8
Posted by Gary Briggs <ch...@icculus.org>.
On Fri, Feb 07, 2014 at 11:02:35AM +0000, Mark Thomas wrote:
> On 07/02/2014 06:32, Gary Briggs wrote:
> > Evening,
> >
> > I've been reading this page: http://wiki.apache.org/tomcat/SSLWithFORMFallback
> > I'm currently using Tomcat 7 on Linux. In short, Neither of the bits
> > of code linked on that page work for me but the thing described in the
> > title is what I desire.
>
> Define what you mean by doesn't work. Also, explain what you did to test it.
Fair enough. Sorry, I should have done that in the first place.
... and now, having just spent and hour reimplementing from scratch and
documenting for this email, it's working just fine.
I'm trying to edit the wiki to add my new one, but apparently those
pages are immutable?
Cheers,
Gary
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL with Form Fallback on Tomcat 7 or 8
Posted by Mark Thomas <ma...@apache.org>.
On 07/02/2014 06:32, Gary Briggs wrote:
> Evening,
>
> I've been reading this page: http://wiki.apache.org/tomcat/SSLWithFORMFallback
> I'm currently using Tomcat 7 on Linux. In short, Neither of the bits
> of code linked on that page work for me but the thing described in the
> title is what I desire.
Define what you mean by doesn't work. Also, explain what you did to test it.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL with Form Fallback on Tomcat 7 or 8
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Gary,
On 2/7/14, 1:32 AM, Gary Briggs wrote:
> Evening,
>
> I've been reading this page:
> http://wiki.apache.org/tomcat/SSLWithFORMFallback I'm currently
> using Tomcat 7 on Linux. In short, Neither of the bits of code
> linked on that page work for me but the thing described in the
> title is what I desire.
>
> I have client certificate authentication working fully within my
> needs, but I'm looking for a fallback so I can support allow users
> without one of the appropriate smart cards being able to get in.
> BasicAuth would also be fine for this project, although I'd much
> rather it were a form.
>
> Additionally, I'm unclear on what the purpose of "optional" is on
> the clientAuth parameter of a Connector,if it's not for the purpose
> of some other fallback authentication mechanism to work. Maybe it's
> just implemented because it's integral to the TLS implementation?
>
> Another option is to configure the trust store appropriately, then
> self-sign certificates and pass them out. That's still a little
> hostile to the users that don't have smartcards in the first place;
> I have my Realm hitting up an LDAP server with a username-pass
> tuple that non-smartcard-wielding users already have an account
> on.
FWIW, use of an SSL client certificate does improve the security by
adding a second factor to the existing username-password tuple that
you already have. For the smart-card users, they already "have"
something, and if they are the kinds of smart cards I know about, they
also require something you know to activate them.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJS9TqtAAoJEBzwKT+lPKRYI0IQAIPrFbqLV701yZSCUkbYMkVZ
xxYSkITliJ9ZqbbHXoDuMDGDgjXY/p7Bjgwarx/e6DCPSpE6I4kCIWj0WkbPJYQZ
D3uV7/132izPDPFpFMwbsmTsQGB/ruvDIO+YsQUQBcbFhSVzRotcTKEjKTimf0wv
CytsIN2Rjkey+xKdyNaj/LIwi+YKSREWoxdWdRJwOmp95xku5BuxOFiaE6Gi2HDP
CCqxyC3zatnocdW+xY86Bw2hKnGLfusBsWrQUnwjjL1FHKl2PZgAhKLqX4zC1k2E
d1LYerXj1co5p34tx6mWD3DkiPxODmRUGymZvJzGSwrz9JuDy9uj6yVU0MDP2/oL
GoHQZFx5KggMIFyj2oiVFnKDz8YGFgij/Q4eeUsAYpx0rssJNTo2eXQ/mArATXqf
YLAR3trNlULYmmPSMKwuVuKF+KI9uAnnyMvl3jPb6yd2nhZH77m3EjaesX/xRrLU
GK0ZDxkbXYdSanP3dCa0ud1qXXfXpli9uIMGVY6lzdRUdrH+t8JQH1rbSPb7nYp3
AakUK/YPd6gPv//3uTmtxFvWW00f9brdP7hHMvVtnQvqjETH4c5sfooMnRWBzpQm
YNoxKie1ekfJ99KVkX2NXVfJUmpUTrrIZTuUGFGhCTuYOKSl26tDtwXra2z6tgkX
HT5cg7/Mlb5gUJBvkJKe
=NEAD
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org