X509 configuration in Jetty

[Ian Bobbitt]

On 12/15/17 6:04 AM, Oluf Færø wrote:
>
> But this creates the behaviour that the users is prompted for the certificate before the login-page is presented in
> the browser.
>
>  
>
> Is it not possible to configure Jetty/Shibboleth in such a way that the users is first presented with the X509
> login-page, and the prompted for the client certificate when he presses the “Certificate Login” button.
>
I wasn't able to get that working under pure Jetty either. I believe it can be made to work under Tomcat, but I haven't
tried.

My production IdPs are behind an Apache proxy for other reasons, so I terminated the client certificate there (which can
renegotiate depending on path) and use a servlet filter to reinject the client's certificate. If you want to go that
route, see the email thread from the list archives <https://marc.info/?t=149817685300004&r=1&w=2> and the issue I opened
when Scott offered to include it with the IdP <https://issues.shibboleth.net/jira/browse/IDP-1199>.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171215/1d7de489/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4090 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20171215/1d7de489/attachment-0001.p7s>