You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Luis Pascual Forner <lp...@ival.com> on 2008/05/27 08:52:26 UTC
Force authentication with client certificate when accesing to a directory
Hello,
I need that the server request client certificate for
authenticate only when access to a certain directory. In
the server Apache that is possible establishing the
properyy "SSLVerifyClient" to "requiere" only for the
directories that require authentication:
...
SSLVerifyClient none
<Directory /directory_that_need_authentication>
SSLVerifyClient require
SSLOptions ...
...
</Directory>
...
It can be done with Tomcat?
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Force authentication with client certificate when accesing to
a directory
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Luis (and Mark),
Mark Thomas wrote:
| Luis Pascual Forner wrote:
|> Thanks Mark,
|>
|> It's mandatory to list the valid users in tomcat-users.xml?
|> I don't know in advance the users. I admit any users that
|> have a valid certificate. It's possible?
|
| Yes, but only at the connector level which probably isn't the degree of
| control you want.
|
| http://securityfilter.sourceforge.net/ may help
Sorry, but there's not yet support in sf for CLIENT-CERT authentication. :(
You could accomplish this with a hand-rolled Filter, though.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkg8zbQACgkQ9CaO5/Lv0PAbHwCgkv+c6W8ksDaLO93howMhobb9
iIQAn0QRt1E7tiDpodOrtNCyouEU73dR
=yZw6
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Force authentication with client certificate when accesing to
a directory
Posted by Mark Thomas <ma...@apache.org>.
Luis Pascual Forner wrote:
> Thanks Mark,
>
> It's mandatory to list the valid users in tomcat-users.xml?
> I don't know in advance the users. I admit any users that
> have a valid certificate. It's possible?
Yes, but only at the connector level which probably isn't the degree of
control you want.
http://securityfilter.sourceforge.net/ may help
Mark
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Force authentication with client certificate when accesing to
a directory
Posted by Luis Pascual Forner <lp...@ival.com>.
Thanks Mark,
It's mandatory to list the valid users in tomcat-users.xml?
I don't know in advance the users. I admit any users that
have a valid certificate. It's possible?
Mark Thomas escribió:
> Luis Pascual Forner wrote:
>> Hello,
>>
>> I need that the server request client certificate for
>> authenticate only when access to a certain directory. In
>> the server Apache that is possible establishing the
>> properyy "SSLVerifyClient" to "requiere" only for the
>> directories that require authentication:
>>
>> ...
>> SSLVerifyClient none
>> <Directory /directory_that_need_authentication>
>> SSLVerifyClient require
>> SSLOptions ...
>> ...
>> </Directory>
>> ...
>>
>> It can be done with Tomcat?
>
> Yes. You need to use an appropriate security constraint in combination
> with CLIENT-CERT authentication. This is all configured in web.xml. See
> the Servlet specification for the details.
>
> You will also need to configure the Realm you are using. This can be
> tricky for CLIENT-CERT (you need to get the user name right) but should
> work with any Realm.
>
> Mark
>
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Force authentication with client certificate when accesing to
a directory
Posted by Mark Thomas <ma...@apache.org>.
Luis Pascual Forner wrote:
> Hello,
>
> I need that the server request client certificate for
> authenticate only when access to a certain directory. In
> the server Apache that is possible establishing the
> properyy "SSLVerifyClient" to "requiere" only for the
> directories that require authentication:
>
> ...
> SSLVerifyClient none
> <Directory /directory_that_need_authentication>
> SSLVerifyClient require
> SSLOptions ...
> ...
> </Directory>
> ...
>
> It can be done with Tomcat?
Yes. You need to use an appropriate security constraint in combination with
CLIENT-CERT authentication. This is all configured in web.xml. See the
Servlet specification for the details.
You will also need to configure the Realm you are using. This can be tricky
for CLIENT-CERT (you need to get the user name right) but should work with
any Realm.
Mark
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org