X509 authn under Jetty

[Cantor, Scott]

On 8/23/16 10:10 AM, Ian Bobbitt wrote:
> 
> I have a proof of concept working by setting NeedClientAuth and
> TrustStorePath/TrustStorePassword, but it requires a
> client cert for any communication. I'd like to have a client cert only
> required for /idp/Authn/X509 so I can display
> instructions, setup links, etc. at the splash screen before redirecting.
> Is that possible with Jetty?

I don't know if it's practical in modern terms with anything; that would
imply rengotiation, and my understanding is that's being phased out as a
really bad thing on all sides.

I don't know if Jetty is smart enough to do that (or dumb enough?). The
fact that I had to mess around with the connector to make the rules in
web.xml work seemed like a giant red flag to me that this wasn't really
a workable solution.

> Are those examples available somewhere?

Pretty sure you just figured them out, or you wouldn't have gotten it to
work this much.

If you change Need to Want, I'm fairly sure that's as good as it gets.
Still breaks IE, IIRC.

The incredibly broken thing is that you have to have the server load up
the CAs to offer to the client to get the cient to do the right thing;
that was what confused me.

If Tomcat's better at this, that may just be an area where it has the
advantage. But I'm not sure it's all that much better.

-- Scott