X509 authn under Jetty

[Ian Bobbitt]

On 8/23/16 10:22 AM, Cantor, Scott wrote:
> On 8/23/16 10:10 AM, Ian Bobbitt wrote:
>>
>> I have a proof of concept working by setting NeedClientAuth and
>> TrustStorePath/TrustStorePassword, but it requires a
>> client cert for any communication. I'd like to have a client cert only
>> required for /idp/Authn/X509 so I can display
>> instructions, setup links, etc. at the splash screen before redirecting.
>> Is that possible with Jetty?
> 
> I don't know if it's practical in modern terms with anything; that would
> imply rengotiation, and my understanding is that's being phased out as a
> really bad thing on all sides.
> 
> I don't know if Jetty is smart enough to do that (or dumb enough?). The
> fact that I had to mess around with the connector to make the rules in
> web.xml work seemed like a giant red flag to me that this wasn't really
> a workable solution.
> 

Is there a better way to do it? Am I missing something obvious?

> If Tomcat's better at this, that may just be an area where it has the
> advantage. But I'm not sure it's all that much better.

>From reading docs <https://tomcat.apache.org/tomcat-8.5-doc/config/http.html#SSL_Support_-_SSLHostConfig>, Tomcat does
appear to support what I want:

certificateVerification: [...] A none value (which is the default) will not require a certificate chain unless the
client requests a resource protected by a security constraint that uses CLIENT-CERT authentication.