X509 configuration in Jetty

[Oluf Færø]

Hi

I am trying to configure X509 client authentication in Jetty.

For this development server I have first enabled HTTPS on the Jetty web server and installed a domain certificate in the keystore signed by a  CA known by the brower. This works.

Now I would like to enable X509 authentication.

For the client certificate I have created a private CA on the server using openssl and created client certificates.

The private CA certificate is imported in to the keystore as a trusted CA.

Then I set idp.authn.flows=X509 in the Shibboleth file idp.properties.

The user is now presented with X509 login page, but the authentication fails because the browser does not submit the certificate when I press the "Certificate Login" button.

It seems that I have to set the property jetty.sslContext.wantClientAuth=true in the jetty base ssl.ini file.

Otherwise Shibboleth does not prompt for the client certificate in the browser.

But this creates the behaviour that the users is prompted for the certificate before the login-page is presented in the browser.

Is it not possible to configure Jetty/Shibboleth in such a way that the users is first presented with the X509 login-page, and the prompted for the client certificate when he presses the "Certificate Login" button.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171215/cf910934/attachment-0001.html>