CLIENT-CERT configuration

[adamw]

Hello,
I want to secure a servlet so that you can connect to it only if you have a certificate.
To do it, firstly I have setup tomcat to support https as in scenarion 3 here:
http://wiki.jboss.org/wiki/Wiki.jsp?page=SSLSetup
The only difference is that in server.xml, I left clientAuth="false", as I want the rest of the pages to be accessible in a normal way.

Later, I configured my web applicaton as it is described here:
http://docs.jboss.org/jbossas/jboss4guide/r5/html/ch8.chapter.html#d0e19521

The result I get is, when I don't have the certificate registered, it denies access, but when I have - I get an error message:
HTTP Status 401 - Cannot authenticate with the provided credentials

Did I miss something?

--
Cheers,
Adam

[j2ee_junkie]

Adam,

First off, see my comments at http://www.jboss.com/index.html?module=bb&op=viewtopic&t=86289.
SSL vs. CLIENT-CERT authentication are two separate issues.

That said, we would need to see some trace logging of JBoss security at the point when a user attempts to access secured resource to see what is going on.

cgriffith

[adamw]

Hello,
thanks for the link, that clarified a little.

Now I'm wondering - where do I put the certificates (server ones - server.keystore file)? Do I bundle them with the web application or put it in the conf directory (I tried both, with the same effect).

I'm not sure also what does "The localhost.keystore would need this cert stored with an alias of CN=unit-tests-client, OU=JBoss Inc., O=JBoss Inc., ST=Washington, C=US and the jmx-console-roles.properties would also need an entry for the same entry." mean - from the manual - should I import the client certifiacte to server.keystore?

Finally, how do you enable trace logging of JBoss Security? I tried adding to log4j.xml:

 <category name="org.jboss.security.auth.spi">
 <priority value="TRACE"/>
 </category>

but that didn't help :)

Thanks,
Adam

[j2ee_junkie]

Adam,

see http://wiki.jboss.org/wiki/Wiki.jsp?page=BaseCertLoginModule ,
http://wiki.jboss.org/wiki/Wiki.jsp?page=JBossSX
, and http://wiki.jboss.org/wiki/Wiki.jsp?page=Logging.

cgriffith

[adamw]

Hello,
I have read the three pages (the first two I have already read before), but they didn't bring any help. I added

 <category name="org.jboss.security">
 <priority value="TRACE" class="org.jboss.logging.XLevel"/>
 </category>

to log4j.xml but still I don't see any logging. Also, I noticed that when I invoke my servlet through https I get "HTTP Status 401 - Cannot authenticate with the provided credentials", and when I invoke it through http I get "HTTP Status 400 - No client certificate chain in this request". I'm still not sure what certificates should be where - files, that is. I assume that server.keystore should contain both server and authorized clients certificates? And that file should be in /serfer/all/conf?

--
Cheers,
Adam