Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <tomcat-user@jakarta.apache.org>
Message-ID: <3E48CC50.7010206@loudcloud.com>
Date: Tue, 11 Feb 2003 05:11:28 -0500
From: Tony Dahbura <tony@loudcloud.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
 rv:1.2.1) Gecko/20021130
MIME-Version: 1.0
To: Tomcat Users List <tomcat-user@jakarta.apache.org>
Subject: help with client certificates
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

I am trying to configure my web application within tomcat to require 
client certificates for certain areas.  I am not concerned about what 
the certificate contains-only that it is a valid certificate (not 
expired).  

I have the ssl piece working and when I use the connector option 
clientAuth="true" this makes my whole ssl session require 
certificates-which is not what I want.  

How can I configure the web.xml file to require certificates for only 
certain servlets/urls of the webapp?  

Would like the same functionality of clientAuth="true" (which just 
checks the validity of the certifiicate but does not try to verify or 
see if the user is in a list somewhere) but at the url/servlet level 
within the web.xml for the web app.


Another quick question is how can one force the user to have to select 
the cert again once inside the web application (simulate a logout). 
 Does invalidating the session force this?  Do not want the user to have 
to quit out of the browser.


Thanks,
Tony


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org