X509 authn under Jetty

[Cantor, Scott]

On 8/23/16 11:27 AM, Ian Bobbitt wrote:
>>
>> I don't know if Jetty is smart enough to do that (or dumb enough?). The
>> fact that I had to mess around with the connector to make the rules in
>> web.xml work seemed like a giant red flag to me that this wasn't really
>> a workable solution.
> 
> Is there a better way to do it? Am I missing something obvious?

I have no idea. I didn't find a way to make Jetty honor the security
constraint unless I configured the connector, but since my goal was
"test my code" and not "do something useful", it wasn't something I
needed to figure out the answer to.

> From reading docs <https://tomcat.apache.org/tomcat-8.5-doc/config/http.html#SSL_Support_-_SSLHostConfig>,
> Tomcat does appear to support what I want:
>
> certificateVerification: [...] A none value (which is the default) will not
> require a certificate chain unless the client requests a resource
protected
> by a security constraint that uses CLIENT-CERT authentication.

That's renegotiation, which as I said seems to be viewed as a "bad
thing" by lots of people these days. I don't know enough to know the
truth about it.

-- Scott