Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <tomcat-user@jakarta.apache.org>
Received-SPF: pass (asf.osuosl.org: domain of jamesrome@gmail.com designates
 64.233.162.204 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:user-agent:x-accept-language:mime-version:to:subject:content-type:content-transfer-encoding;
        b=gA1Z72h3EBwjKWiA5t6boPy6pCCrH5xa1GNk93yljG9b+ZDwTy470t1iwe/7cieVdR8kdLpyOomd51rRUb/Jrh/YzWlI0p6RswEN7LsyMjyY15Ma3sRcnUUAOFioce+7KitrDrllHMgqZiwqpgXXzQR2PIZLzWysG54q0XUySy4=
Message-ID: <433AF1D1.4090705@gmail.com>
Date: Wed, 28 Sep 2005 15:41:05 -0400
From: James Rome <jamesrome@gmail.com>
User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317)
MIME-Version: 1.0
To: tomcat-user@jakarta.apache.org
Subject: Realms and certificates
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

None of the standard realms do certificates properly. For example,
o.a.c.authenticator.SSLAuthenticator.java does not check to see if a
certificate has been revoked. The LDAP realm compares the presented
certificate to the one in the LDAP which puts a burden on the LDAP to
unpublish revoked certificates. This is also rather unnecessary because
given the CA certifdicate and the OCSP address, any presented
certificate can be authenticated properly.

So I write my own Realm by extending RealmBase and modifying the public
Principal authenticate(X509Certificate certs[]) method.
I put this realm inside the <Engine> tag and commented out the
userdatabase realm. But, so far as I can tell, my authenticate method is
never called. Print statements (using the 5.5 log techniques) only
appear from the start() method, never from authenticate(). And I can get
in with revoked client certificates.

Does anyone have an idea of what is happening? How can I debug this?

Thanks,
Jim Rome

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org