<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 12/15/17 6:04 AM, Oluf Færø wrote:<br>
<blockquote type="cite"
cite="mid:HE1PR04MB1531CC85A01EC72A66961557D20B0@HE1PR04MB1531.eurprd04.prod.outlook.com">
<p class="MsoNormal"><span
style="font-size:8.5pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DA"
lang="EN-US">But this creates the behaviour that the users is
prompted for the certificate before the login-page is
presented in the browser.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.5pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DA"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.5pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DA"
lang="EN-US">Is it not possible to configure Jetty/Shibboleth
in such a way that the users is first presented with the X509
login-page, and the prompted for the client certificate when
he presses the “Certificate Login” button.</span></p>
</blockquote>
I wasn't able to get that working under pure Jetty either. I believe
it can be made to work under Tomcat, but I haven't tried.<br>
<br>
My production IdPs are behind an Apache proxy for other reasons, so
I terminated the client certificate there (which can renegotiate
depending on path) and use a servlet filter to reinject the client's
certificate. If you want to go that route, see the email thread from
the list archives
<a class="moz-txt-link-rfc2396E" href="https://marc.info/?t=149817685300004&r=1&w=2"><https://marc.info/?t=149817685300004&r=1&w=2></a> and the
issue I opened when Scott offered to include it with the IdP
<a class="moz-txt-link-rfc2396E" href="https://issues.shibboleth.net/jira/browse/IDP-1199"><https://issues.shibboleth.net/jira/browse/IDP-1199></a>.<br>
<br>
</body>
</html>