You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Jeffrey Janner <Je...@PolyDyne.com> on 2012/07/11 18:35:30 UTC
Client Authentication using SSL
Looking into implemented two-factor Auth for Tomcat with first factor being our current userid/password form.
I figured that the second factor could be Client Authentication using SSL, as it seems readily available in Tomcat.
Aside from the wonderful Tomcat documentation on configuring the <connector> element, does anyone else have any suggested reading on the subject?
Any gotchas I should look for?
Jeffrey Janner
__________________________________________________________________________
Confidentiality Notice: This Transmission (including any attachments) may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this transmission in error, please immediately reply to the sender or telephone (512) 343-9100 and delete this transmission from your system.
Re: Client Authentication using SSL
Posted by Pid <pi...@pidster.com>.
On 12/07/2012 20:10, Burghard W.V. Britzke wrote:
> ?!
Yep, I have no idea what they're on about either.
:P
p
> Am 12.07.2012 um 19:22 schrieb Puneet Dewan:
>
>> The below way I used to deploy the war and able to use it :)
>>
>>
>> ---------- Forwarded message ----------
>> From: Puneet Dewan <pu...@gmail.com>
>> Date: Thu, Jul 12, 2012 at 10:19 PM
>> Subject: Re: Client Authentication using SSL
>> To: Tomcat Users List <us...@tomcat.apache.org>
>>
>>
>> Excellent suggestions and the link at the bottom .
>> On my local machine using keystore and keypass was not working while I was
>> configuring a WAR on https.
>> I made use of truststoreFile and truststorePass in connector tag.
>> e.g
>>
>> < Connector SSLEnabled="true"
>> acceptCount="100"
>> connectionTimeout="20000"
>> executor="tomcatThreadPool"
>> keyAlias="tomcat"
>> keystoreFile="${catalina.base}/conf/tomcat.keystore"
>> keystorePass="changeme"
>>
>> truststoreFile="${catalina.base}/conf/tomcat.keystore"
>> truststorePass="changeme"
>> maxKeepAliveRequests="15"
>> port="8443"
>> protocol="org.apache.coyote.http11.Http11Protocol"
>> redirectPort="8443"
>> scheme="https"
>> secure="true"/>
>>
>>
>>
>> On Wed, Jul 11, 2012 at 10:05 PM, Jeffrey Janner <
>> Jeffrey.Janner@polydyne.com> wrote:
>>
>>> Looking into implemented two-factor Auth for Tomcat with first factor
>>> being our current userid/password form.
>>> I figured that the second factor could be Client Authentication using SSL,
>>> as it seems readily available in Tomcat.
>>> Aside from the wonderful Tomcat documentation on configuring the
>>> <connector> element, does anyone else have any suggested reading on the
>>> subject?
>>> Any gotchas I should look for?
>>>
>>> Jeffrey Janner
>>> __________________________________________________________________________
>>>
>>> Confidentiality Notice: This Transmission (including any attachments) may
>>> contain information that is privileged, confidential, and exempt from
>>> disclosure under applicable law. If the reader of this message is not the
>>> intended recipient you are hereby notified that any dissemination,
>>> distribution, or copying of this communication is strictly prohibited.
>>>
>>> If you have received this transmission in error, please immediately reply
>>> to the sender or telephone (512) 343-9100 and delete this transmission from
>>> your system.
>>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
--
[key:62590808]
Re: Client Authentication using SSL
Posted by "Burghard W.V. Britzke" <bu...@charmides.in-berlin.de>.
?!
Am 12.07.2012 um 19:22 schrieb Puneet Dewan:
> The below way I used to deploy the war and able to use it :)
>
>
> ---------- Forwarded message ----------
> From: Puneet Dewan <pu...@gmail.com>
> Date: Thu, Jul 12, 2012 at 10:19 PM
> Subject: Re: Client Authentication using SSL
> To: Tomcat Users List <us...@tomcat.apache.org>
>
>
> Excellent suggestions and the link at the bottom .
> On my local machine using keystore and keypass was not working while I was
> configuring a WAR on https.
> I made use of truststoreFile and truststorePass in connector tag.
> e.g
>
> < Connector SSLEnabled="true"
> acceptCount="100"
> connectionTimeout="20000"
> executor="tomcatThreadPool"
> keyAlias="tomcat"
> keystoreFile="${catalina.base}/conf/tomcat.keystore"
> keystorePass="changeme"
>
> truststoreFile="${catalina.base}/conf/tomcat.keystore"
> truststorePass="changeme"
> maxKeepAliveRequests="15"
> port="8443"
> protocol="org.apache.coyote.http11.Http11Protocol"
> redirectPort="8443"
> scheme="https"
> secure="true"/>
>
>
>
> On Wed, Jul 11, 2012 at 10:05 PM, Jeffrey Janner <
> Jeffrey.Janner@polydyne.com> wrote:
>
>> Looking into implemented two-factor Auth for Tomcat with first factor
>> being our current userid/password form.
>> I figured that the second factor could be Client Authentication using SSL,
>> as it seems readily available in Tomcat.
>> Aside from the wonderful Tomcat documentation on configuring the
>> <connector> element, does anyone else have any suggested reading on the
>> subject?
>> Any gotchas I should look for?
>>
>> Jeffrey Janner
>> __________________________________________________________________________
>>
>> Confidentiality Notice: This Transmission (including any attachments) may
>> contain information that is privileged, confidential, and exempt from
>> disclosure under applicable law. If the reader of this message is not the
>> intended recipient you are hereby notified that any dissemination,
>> distribution, or copying of this communication is strictly prohibited.
>>
>> If you have received this transmission in error, please immediately reply
>> to the sender or telephone (512) 343-9100 and delete this transmission from
>> your system.
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Fwd: Client Authentication using SSL
Posted by Puneet Dewan <pu...@gmail.com>.
The below way I used to deploy the war and able to use it :)
---------- Forwarded message ----------
From: Puneet Dewan <pu...@gmail.com>
Date: Thu, Jul 12, 2012 at 10:19 PM
Subject: Re: Client Authentication using SSL
To: Tomcat Users List <us...@tomcat.apache.org>
Excellent suggestions and the link at the bottom .
On my local machine using keystore and keypass was not working while I was
configuring a WAR on https.
I made use of truststoreFile and truststorePass in connector tag.
e.g
< Connector SSLEnabled="true"
acceptCount="100"
connectionTimeout="20000"
executor="tomcatThreadPool"
keyAlias="tomcat"
keystoreFile="${catalina.base}/conf/tomcat.keystore"
keystorePass="changeme"
truststoreFile="${catalina.base}/conf/tomcat.keystore"
truststorePass="changeme"
maxKeepAliveRequests="15"
port="8443"
protocol="org.apache.coyote.http11.Http11Protocol"
redirectPort="8443"
scheme="https"
secure="true"/>
On Wed, Jul 11, 2012 at 10:05 PM, Jeffrey Janner <
Jeffrey.Janner@polydyne.com> wrote:
> Looking into implemented two-factor Auth for Tomcat with first factor
> being our current userid/password form.
> I figured that the second factor could be Client Authentication using SSL,
> as it seems readily available in Tomcat.
> Aside from the wonderful Tomcat documentation on configuring the
> <connector> element, does anyone else have any suggested reading on the
> subject?
> Any gotchas I should look for?
>
> Jeffrey Janner
> __________________________________________________________________________
>
> Confidentiality Notice: This Transmission (including any attachments) may
> contain information that is privileged, confidential, and exempt from
> disclosure under applicable law. If the reader of this message is not the
> intended recipient you are hereby notified that any dissemination,
> distribution, or copying of this communication is strictly prohibited.
>
> If you have received this transmission in error, please immediately reply
> to the sender or telephone (512) 343-9100 and delete this transmission from
> your system.
>
Re: Client Authentication using SSL
Posted by Puneet Dewan <pu...@gmail.com>.
Excellent suggestions and the link at the bottom .
On my local machine using keystore and keypass was not working while I was
configuring a WAR on https.
I made use of truststoreFile and truststorePass in connector tag.
e.g
< Connector SSLEnabled="true"
acceptCount="100"
connectionTimeout="20000"
executor="tomcatThreadPool"
keyAlias="tomcat"
keystoreFile="${catalina.base}/conf/tomcat.keystore"
keystorePass="changeme"
truststoreFile="${catalina.base}/conf/tomcat.keystore"
truststorePass="changeme"
maxKeepAliveRequests="15"
port="8443"
protocol="org.apache.coyote.http11.Http11Protocol"
redirectPort="8443"
scheme="https"
secure="true"/>
On Wed, Jul 11, 2012 at 10:05 PM, Jeffrey Janner <
Jeffrey.Janner@polydyne.com> wrote:
> Looking into implemented two-factor Auth for Tomcat with first factor
> being our current userid/password form.
> I figured that the second factor could be Client Authentication using SSL,
> as it seems readily available in Tomcat.
> Aside from the wonderful Tomcat documentation on configuring the
> <connector> element, does anyone else have any suggested reading on the
> subject?
> Any gotchas I should look for?
>
> Jeffrey Janner
> __________________________________________________________________________
>
> Confidentiality Notice: This Transmission (including any attachments) may
> contain information that is privileged, confidential, and exempt from
> disclosure under applicable law. If the reader of this message is not the
> intended recipient you are hereby notified that any dissemination,
> distribution, or copying of this communication is strictly prohibited.
>
> If you have received this transmission in error, please immediately reply
> to the sender or telephone (512) 343-9100 and delete this transmission from
> your system.
>
RE: Client Authentication using SSL
Posted by Jeffrey Janner <Je...@PolyDyne.com>.
> -----Original Message-----
> From: Christopher Schultz [mailto:chris@christopherschultz.net]
> Sent: Tuesday, July 17, 2012 9:14 AM
> To: Tomcat Users List
> Subject: Re: Client Authentication using SSL
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Jeffrey,
>
> On 7/16/12 10:01 AM, Jeffrey Janner wrote:
> > Thanks Chris, I'd seen a lot of traffic on the topic over the years,
> > so knew someone had real-world experience on the subject.
> > I'll check out what you did a little further. Of course, thinking on
> > my proposed plan, a really uptight security admin might not think it
> > all that more secure that basic-auth over server-only SSL. You know
> > the type: the guy that insists the SSLPassword value in server.xml be
> > encrypted.
>
> Yup.
>
> SSL client certificates are great because it's basically impossible to
> fake them, and once they are installed, you don't have anything to
> remember (like a passphrase). So, you can do super-high-grade
> authentication one-time, then issue the SSL cert to avoid all that in
> the future. Plus, they can be revoked.
>
> They can, however, be trivially copied and moved elsewhere. So, you
> might want to couple the SSL certificate with some other kind of
> authentication like passphrase or even just remote IP address checking.
>
> The other nice thing is that you don't need the original issuing-
> certificate's key in order to verify the authenticity of the client
> cert: you can install the CA (and subs) certs on the server and verify
> the validity of the client certificate without revealing any secrets on
> the server (like the secret for the server's key, for instance). That
> allows you to keep your super-secret CA keys under lock and key but
> still use them for authentication purposes.
>
> The real question is whether or not it gives you anything more secure
> than what you already have (I dunno what you already have). The SSL
> connection takes care of the security of the information in-transit.
> The client SSL cert takes care of one factor of authentication: it's
> something the remote client "has". Any security expert will tell you
> that multi-factor authentication is superior (and they'd be right) but
> you still have the problem of distribution of the token *plus* the
> authentication of the user before issuing the token. For example, if
> your authentication is non-existent for client-cert issuance, then the
> second "factor" for authentication into your primary system is entirely
> useless.
>
> Web-based authentication is difficult to do in a really good way.
> Sure, there are good tools (GPG, X509, etc.) and tried-and-true
> procedures (username/password/PIN/whatever) but when it comes down to
> it, allowing remote access to sensitive data is inherently risky. When
> it comes right down to it, even a very well-implemented system still
> needs to be used by humans, who will invariably find a way to poke
> holes in your security -- say, by putting their passwords on post-its
> on their monitors. Really, it's the humans that really mess up security
> for everyone ;)
>
> - -chris
Chris -
Right now, my auth is just a user/pw form put up over SSL.
I figured adding the client-cert-auth to the SSL connection and then throwing up my form as usual would be a good next step. That way I've verified the client system is approved, and so is the users. Still could have a disconnect in that the cert is approved, but not necessarily for the userid involved.
I've seen some how-tos that suggest putting the userid as the cname on the cert and then requiring the matching pw. It's certainly more secure, and solves the problem of approved user A masquerading as approved user B that is allowed by my first step. However, it also requires reworking the app to pull the uid from the cert, and is probably a level of security above what most of my customer base cares about.
I'm basically looking at alternatives for future business into sites that really want that extra level of security. There are potentially other methods of providing for the higher security at those installations. For example, some have their own extranet which is heavily tied down, and we could go in behind that. Then I don't really care anymore, as the high-level stuff was already done just to get on the network.
For future sales, it's basically going to require discussions of what they think is appropriate.
Thanks again for your help.
Jeff
__________________________________________________________________________
Confidentiality Notice: This Transmission (including any attachments) may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this transmission in error, please immediately reply to the sender or telephone (512) 343-9100 and delete this transmission from your system.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Client Authentication using SSL
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Jeffrey,
On 7/16/12 10:01 AM, Jeffrey Janner wrote:
> Thanks Chris, I'd seen a lot of traffic on the topic over the
> years, so knew someone had real-world experience on the subject.
> I'll check out what you did a little further. Of course, thinking
> on my proposed plan, a really uptight security admin might not
> think it all that more secure that basic-auth over server-only
> SSL. You know the type: the guy that insists the SSLPassword value
> in server.xml be encrypted.
Yup.
SSL client certificates are great because it's basically impossible to
fake them, and once they are installed, you don't have anything to
remember (like a passphrase). So, you can do super-high-grade
authentication one-time, then issue the SSL cert to avoid all that in
the future. Plus, they can be revoked.
They can, however, be trivially copied and moved elsewhere. So, you
might want to couple the SSL certificate with some other kind of
authentication like passphrase or even just remote IP address checking.
The other nice thing is that you don't need the original
issuing-certificate's key in order to verify the authenticity of the
client cert: you can install the CA (and subs) certs on the server and
verify the validity of the client certificate without revealing any
secrets on the server (like the secret for the server's key, for
instance). That allows you to keep your super-secret CA keys under
lock and key but still use them for authentication purposes.
The real question is whether or not it gives you anything more secure
than what you already have (I dunno what you already have). The SSL
connection takes care of the security of the information in-transit.
The client SSL cert takes care of one factor of authentication: it's
something the remote client "has". Any security expert will tell you
that multi-factor authentication is superior (and they'd be right) but
you still have the problem of distribution of the token *plus* the
authentication of the user before issuing the token. For example, if
your authentication is non-existent for client-cert issuance, then the
second "factor" for authentication into your primary system is
entirely useless.
Web-based authentication is difficult to do in a really good way.
Sure, there are good tools (GPG, X509, etc.) and tried-and-true
procedures (username/password/PIN/whatever) but when it comes down to
it, allowing remote access to sensitive data is inherently risky. When
it comes right down to it, even a very well-implemented system still
needs to be used by humans, who will invariably find a way to poke
holes in your security -- say, by putting their passwords on post-its
on their monitors. Really, it's the humans that really mess up
security for everyone ;)
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAlAFcycACgkQ9CaO5/Lv0PAYHwCeI2V4++1mMCTRrqUpipBnswHV
cyAAn0rROWS47++js5IMM7iFg0BRgZAk
=zbGQ
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Client Authentication using SSL
Posted by Jeffrey Janner <Je...@PolyDyne.com>.
Thanks Chris,
I'd seen a lot of traffic on the topic over the years, so knew someone had real-world experience on the subject.
I'll check out what you did a little further.
Of course, thinking on my proposed plan, a really uptight security admin might not think it all that more secure that basic-auth over server-only SSL.
You know the type: the guy that insists the SSLPassword value in server.xml be encrypted.
Jeff
> -----Original Message-----
> From: Christopher Schultz [mailto:chris@christopherschultz.net]
> Sent: Friday, July 13, 2012 9:30 PM
> To: Tomcat Users List
> Subject: Re: Client Authentication using SSL
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Jeffrey,
>
> On 7/12/12 9:44 AM, Jeffrey Janner wrote:
> > Is there anyone who's implemented true-client SSL auth over APR that
> > would be willing to share hints/tips on how they handled certificate
> > distributions, etc.?
>
> I wasn't using APR -- though it shouldn't be too terrible to switch
> from JSK configuration to openssl ; openssl is a *lot* more
> straightforward IMO -- and I wasn't actually using CLIENT-AUTH, but I
> did some playing-around a few years ago and posted a bunch to the list
> about it. Here's on of the threads:
> http://markmail.org/thread/vxwwli5nzt4itfr2
>
> You could also look around the archives in the same general time period
> (fall 2009) for other semi-related posts by me. I wasn't able to find a
> post that said "Here's what I actually got working" though I'm
> reasonably certain I actually did do that.
>
> Finally, there is a (relatively) new <Realm> configuration attribute
> that you might want to check out if you want to use CLIENT-CERT:
> X509UsernameRetrieverClassName
>
> http://tomcat.apache.org/tomcat-7.0-doc/config/realm.html
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAlAA2acACgkQ9CaO5/Lv0PApAwCgrbYroL5Ywjh2MvBZ1qzcBCAS
> wtMAni9T0f9K17xG3AN7IsdCxZZtPurr
> =N6zS
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
__________________________________________________________________________
Confidentiality Notice: This Transmission (including any attachments) may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this transmission in error, please immediately reply to the sender or telephone (512) 343-9100 and delete this transmission from your system.
Re: Client Authentication using SSL
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Jeffrey,
On 7/12/12 9:44 AM, Jeffrey Janner wrote:
> Is there anyone who's implemented true-client SSL auth over APR
> that would be willing to share hints/tips on how they handled
> certificate distributions, etc.?
I wasn't using APR -- though it shouldn't be too terrible to switch
from JSK configuration to openssl ; openssl is a *lot* more
straightforward IMO -- and I wasn't actually using CLIENT-AUTH, but I
did some playing-around a few years ago and posted a bunch to the list
about it. Here's on of the threads:
http://markmail.org/thread/vxwwli5nzt4itfr2
You could also look around the archives in the same general time
period (fall 2009) for other semi-related posts by me. I wasn't able
to find a post that said "Here's what I actually got working" though
I'm reasonably certain I actually did do that.
Finally, there is a (relatively) new <Realm> configuration attribute
that you might want to check out if you want to use CLIENT-CERT:
X509UsernameRetrieverClassName
http://tomcat.apache.org/tomcat-7.0-doc/config/realm.html
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAlAA2acACgkQ9CaO5/Lv0PApAwCgrbYroL5Ywjh2MvBZ1qzcBCAS
wtMAni9T0f9K17xG3AN7IsdCxZZtPurr
=N6zS
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Client Authentication using SSL
Posted by Jeffrey Janner <Je...@PolyDyne.com>.
Thanks Burghard. That's a start, provides a little understanding.
Seems to be more about securing httpd<->Tomcat than client<->Tomcat, but I'm sure the concept is the same.
That page does seem to be about the java-based standard connector, and I'm using the APR connector, which is a bit different in configuration. I did notice that I probably need to read the OpenSSL docs a bit more also.
Is there anyone who's implemented true-client SSL auth over APR that would be willing to share hints/tips on how they handled certificate distributions, etc.?
> -----Original Message-----
> From: burghard.britzke [mailto:bubi@charmides.in-berlin.de]
> Sent: Thursday, July 12, 2012 1:11 AM
> To: Tomcat Users List
> Subject: Re: Client Authentication using SSL
>
> may be that article helps:
> http://www.tomcatexpert.com/blog/2012/07/10/enabling-ssl-communication-
> and-client-certificate-authentication-between-apache-web-
>
> burghard.
>
> Am 12.07.2012 um 01:25 schrieb Jeffrey Janner:
>
> > Reposting to the list, as that's the way....
> >
> > Esmond,
> > We already implement your solution, with the exception of the SSL
> Client Certificate.
> > That is what I was aiming for.
> > Thanks for the pointer to AuthenticRoast. We'll give it a look.
> > I've also seen something in the Apache tools called TripleSec which
> looks interesting. But really just looking for some additional info on
> how the client SSL stuff really works.
> > Jeff
> >
> >> -----Original Message-----
> >> From: Esmond Pitt [mailto:esmond.pitt@bigpond.com]
> >> Sent: Wednesday, July 11, 2012 5:58 PM
> >> To: Jeffrey Janner
> >> Subject: RE: Client Authentication using SSL
> >>
> >> Jeffrey
> >>
> >> 'Two-factor authentication' isn't supported by Tomcat natively. Have
> >> a look for a package in Google Code called AuthenticRoast. I
> >> contributed a JAAS layer to it myself. I am using it for a scenario
> >> where I have these
> >> 'factors':
> >>
> >> - SSL client certificate
> >> - 'ticket' (a UID in the URL, e.g. for password resets)
> >> - form
> >>
> >>
> >> EJP
> >>
> >> -----Original Message-----
> >> From: Jeffrey Janner [mailto:Jeffrey.Janner@PolyDyne.com]
> >> Sent: Thursday, 12 July 2012 3:15 AM
> >> To: 'Tomcat Users List'
> >> Subject: RE: Client Authentication using SSL
> >>
> >>> -----Original Message-----
> >>> From: Jeffrey Janner [mailto:Jeffrey.Janner@PolyDyne.com]
> >>> Sent: Wednesday, July 11, 2012 11:36 AM
> >>> To: 'Tomcat Users List'
> >>> Subject: Client Authentication using SSL
> >>>
> >>> Looking into implemented two-factor Auth for Tomcat with first
> >>> factor being our current userid/password form.
> >>> I figured that the second factor could be Client Authentication
> >>> using SSL, as it seems readily available in Tomcat.
> >>> Aside from the wonderful Tomcat documentation on configuring the
> >>> <connector> element, does anyone else have any suggested reading on
> >>> the subject?
> >>> Any gotchas I should look for?
> >>>
> >>> Jeffrey Janner
> >>>
> >>
> _____________________________________________________________________
> >> _
> >>> _
> >>
> >> Forgot to mention that I'd be running under APR/native.
> >>
> _____________________________________________________________________
> >> __
> >> ___
> >>
> >> Confidentiality Notice: This Transmission (including any
> >> attachments) may contain information that is privileged,
> >> confidential, and exempt from disclosure under applicable law. If
> >> the reader of this message is not the intended recipient you are
> >> hereby notified that any dissemination, distribution, or copying of
> >> this communication is strictly prohibited.
> >>
> >> If you have received this transmission in error, please immediately
> >> reply to the sender or telephone (512) 343-9100 and delete this
> >> transmission from your system.
> >>
> >>
> >>
> >
> >
> ______________________________________________________________________
> > ____
> >
> > Confidentiality Notice: This Transmission (including any
> attachments) may contain information that is privileged, confidential,
> and exempt from disclosure under applicable law. If the reader of this
> message is not the intended recipient you are hereby notified that any
> dissemination, distribution, or copying of this communication is
> strictly prohibited.
> >
> > If you have received this transmission in error, please immediately
> reply to the sender or telephone (512) 343-9100 and delete this
> transmission from your system.
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: users-help@tomcat.apache.org
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
__________________________________________________________________________
Confidentiality Notice: This Transmission (including any attachments) may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this transmission in error, please immediately reply to the sender or telephone (512) 343-9100 and delete this transmission from your system.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Client Authentication using SSL
Posted by "burghard.britzke" <bu...@charmides.in-berlin.de>.
may be that article helps: http://www.tomcatexpert.com/blog/2012/07/10/enabling-ssl-communication-and-client-certificate-authentication-between-apache-web-
burghard.
Am 12.07.2012 um 01:25 schrieb Jeffrey Janner:
> Reposting to the list, as that's the way....
>
> Esmond,
> We already implement your solution, with the exception of the SSL Client Certificate.
> That is what I was aiming for.
> Thanks for the pointer to AuthenticRoast. We'll give it a look.
> I've also seen something in the Apache tools called TripleSec which looks interesting. But really just looking for some additional info on how the client SSL stuff really works.
> Jeff
>
>> -----Original Message-----
>> From: Esmond Pitt [mailto:esmond.pitt@bigpond.com]
>> Sent: Wednesday, July 11, 2012 5:58 PM
>> To: Jeffrey Janner
>> Subject: RE: Client Authentication using SSL
>>
>> Jeffrey
>>
>> 'Two-factor authentication' isn't supported by Tomcat natively. Have a
>> look for a package in Google Code called AuthenticRoast. I contributed
>> a JAAS layer to it myself. I am using it for a scenario where I have
>> these
>> 'factors':
>>
>> - SSL client certificate
>> - 'ticket' (a UID in the URL, e.g. for password resets)
>> - form
>>
>>
>> EJP
>>
>> -----Original Message-----
>> From: Jeffrey Janner [mailto:Jeffrey.Janner@PolyDyne.com]
>> Sent: Thursday, 12 July 2012 3:15 AM
>> To: 'Tomcat Users List'
>> Subject: RE: Client Authentication using SSL
>>
>>> -----Original Message-----
>>> From: Jeffrey Janner [mailto:Jeffrey.Janner@PolyDyne.com]
>>> Sent: Wednesday, July 11, 2012 11:36 AM
>>> To: 'Tomcat Users List'
>>> Subject: Client Authentication using SSL
>>>
>>> Looking into implemented two-factor Auth for Tomcat with first factor
>>> being our current userid/password form.
>>> I figured that the second factor could be Client Authentication using
>>> SSL, as it seems readily available in Tomcat.
>>> Aside from the wonderful Tomcat documentation on configuring the
>>> <connector> element, does anyone else have any suggested reading on
>>> the subject?
>>> Any gotchas I should look for?
>>>
>>> Jeffrey Janner
>>>
>> ______________________________________________________________________
>>> _
>>
>> Forgot to mention that I'd be running under APR/native.
>> _______________________________________________________________________
>> ___
>>
>> Confidentiality Notice: This Transmission (including any attachments)
>> may contain information that is privileged, confidential, and exempt
>> from disclosure under applicable law. If the reader of this message is
>> not the intended recipient you are hereby notified that any
>> dissemination, distribution, or copying of this communication is
>> strictly prohibited.
>>
>> If you have received this transmission in error, please immediately
>> reply to the sender or telephone (512) 343-9100 and delete this
>> transmission from your system.
>>
>>
>>
>
> __________________________________________________________________________
>
> Confidentiality Notice: This Transmission (including any attachments) may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
>
> If you have received this transmission in error, please immediately reply to the sender or telephone (512) 343-9100 and delete this transmission from your system.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Client Authentication using SSL
Posted by Jeffrey Janner <Je...@PolyDyne.com>.
Reposting to the list, as that's the way....
Esmond,
We already implement your solution, with the exception of the SSL Client Certificate.
That is what I was aiming for.
Thanks for the pointer to AuthenticRoast. We'll give it a look.
I've also seen something in the Apache tools called TripleSec which looks interesting. But really just looking for some additional info on how the client SSL stuff really works.
Jeff
> -----Original Message-----
> From: Esmond Pitt [mailto:esmond.pitt@bigpond.com]
> Sent: Wednesday, July 11, 2012 5:58 PM
> To: Jeffrey Janner
> Subject: RE: Client Authentication using SSL
>
> Jeffrey
>
> 'Two-factor authentication' isn't supported by Tomcat natively. Have a
> look for a package in Google Code called AuthenticRoast. I contributed
> a JAAS layer to it myself. I am using it for a scenario where I have
> these
> 'factors':
>
> - SSL client certificate
> - 'ticket' (a UID in the URL, e.g. for password resets)
> - form
>
>
> EJP
>
> -----Original Message-----
> From: Jeffrey Janner [mailto:Jeffrey.Janner@PolyDyne.com]
> Sent: Thursday, 12 July 2012 3:15 AM
> To: 'Tomcat Users List'
> Subject: RE: Client Authentication using SSL
>
> > -----Original Message-----
> > From: Jeffrey Janner [mailto:Jeffrey.Janner@PolyDyne.com]
> > Sent: Wednesday, July 11, 2012 11:36 AM
> > To: 'Tomcat Users List'
> > Subject: Client Authentication using SSL
> >
> > Looking into implemented two-factor Auth for Tomcat with first factor
> > being our current userid/password form.
> > I figured that the second factor could be Client Authentication using
> > SSL, as it seems readily available in Tomcat.
> > Aside from the wonderful Tomcat documentation on configuring the
> > <connector> element, does anyone else have any suggested reading on
> > the subject?
> > Any gotchas I should look for?
> >
> > Jeffrey Janner
> >
> ______________________________________________________________________
> > _
>
> Forgot to mention that I'd be running under APR/native.
> _______________________________________________________________________
> ___
>
> Confidentiality Notice: This Transmission (including any attachments)
> may contain information that is privileged, confidential, and exempt
> from disclosure under applicable law. If the reader of this message is
> not the intended recipient you are hereby notified that any
> dissemination, distribution, or copying of this communication is
> strictly prohibited.
>
> If you have received this transmission in error, please immediately
> reply to the sender or telephone (512) 343-9100 and delete this
> transmission from your system.
>
>
>
__________________________________________________________________________
Confidentiality Notice: This Transmission (including any attachments) may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this transmission in error, please immediately reply to the sender or telephone (512) 343-9100 and delete this transmission from your system.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Client Authentication using SSL
Posted by Jeffrey Janner <Je...@PolyDyne.com>.
> -----Original Message-----
> From: Jeffrey Janner [mailto:Jeffrey.Janner@PolyDyne.com]
> Sent: Wednesday, July 11, 2012 11:36 AM
> To: 'Tomcat Users List'
> Subject: Client Authentication using SSL
>
> Looking into implemented two-factor Auth for Tomcat with first factor
> being our current userid/password form.
> I figured that the second factor could be Client Authentication using
> SSL, as it seems readily available in Tomcat.
> Aside from the wonderful Tomcat documentation on configuring the
> <connector> element, does anyone else have any suggested reading on the
> subject?
> Any gotchas I should look for?
>
> Jeffrey Janner
> _______________________________________________________________________
Forgot to mention that I'd be running under APR/native.
__________________________________________________________________________
Confidentiality Notice: This Transmission (including any attachments) may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this transmission in error, please immediately reply to the sender or telephone (512) 343-9100 and delete this transmission from your system.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org