Certificate and form login in one WAR

[xmedeko]

Hi,
is it possible to have in one WAR: one servlet protected by a certificate authentication and the another servlet protected by FORM authentication?

Thanks

[jfclere]

Yep just have 2 security-constraint in the web.xml one with:

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

the other with something like:

 <auth-constraint>
 <role-name>manager</role-name>
 </auth-constraint>

[xmedeko]

No, I do not mean transport CONFIDENTIAL, I mean client certificate authentication (CLIENT-CERT).

I.e. one servlet can be accesses only by a client with certain certificate (CLIENT-CERT) method, and another servlet accessed by user:password (FORM).

The servlet accessed by the CLIENT-CERT method is in fact accessed just by a Java Swing application, not by the browser. So I think I may code some solution, like that the Java app will send certificate in POST data.

[jfclere]

You can't have a multiple login-config in the web.xml of a webapp.

[xmedeko]

Hmm, yeah, thanks.

[xmedeko]

Finally, i have found this http://wiki.apache.org/tomcat/SSLWithFORMFallback