IE 6.0 Mutual auth with Sun One 8

Question

Hello,
What I intend to do - generate new server key pair, then generate client key pair. Export client pair to IE (newest) for mutual auth.
Command I use:
Server pair:
1. keytool -genkey -keyalg rsa -keystore keystore.jks -storepass pass -alias server -dname "cn=www.myCompany.com,o=O2,ou=Ou2,L=W,C=US,S=W"
2. keytool -export -alias server -file server.cer -keystore keystore.jks --storepass pass
3. keytool -noprompt -import -v -trustcacerts -file server.cer -alias server -keystore cacerts.jks -storepass pass2
Client pair:
1. keytool -genkey -keyalg rsa -keystore keystore.jks -storepass ssaperots -alias client -dname "cn=client1,o=O2,ou=Ou2,L=W,C=US,S=W"
2. keytool -export -alias client -file client.cer -keystore keystore.jks --storepass pass
3. keytool -noprompt -import -v -trustcacerts -file client.cer -alias client -keystore
cacerts.jks -storepass pass2
Now I replace domain1/cacerts.jks and domain1/keystore.jks with new files, restart the server.
Mutual auth with jax-rpc from j2ee tutorial works flawlessly.
Finally I want IE to be able to do mutual auth:
Using jstk-1.0.1 from http://www.j2ee-security.net/book/dnldsrc/
jstk-1.0.1/bin/crypttool.sh export -keystore keystore.jks -alias client -storepass pass -outform PKCS12
I have client.p12 which I import into IE personal certificates.
Enter secure site on the server. Server cert is OK. I choose client1 pair for mutual auth.
Then I see in the browser: HTTP Status 403 - Access to the requested resource has been denied.
During the handshake in server.log I see:
[#|2004-06-02T01:12:42.496+0200|WARNING|j2ee-appserver1.4|org.apache.coyote.http11.Http11Processor|_ThreadID=11;|
Exception getting SSL Cert
java.net.SocketException: Socket Closed
a lot of stuff here
[at the end]
http1043-Processor3, handling exception: java.net.SocketTimeoutException: Read
I tries also additional java security package with JDK 1.5.0 beta to generate PKCS12 pair.
The same error diffrent exceptions.
Question:
1. Did I do something wrong ?
2. Is the PKCS12 file corrupted in some way ?
Thank You.

Answer 1

OK. I answer to my own question ;)
The problem I described in post 1 didn't even exist. I figured it by changing admin console to use mutual auth. It works.
However I change the question. I modify bookstore2 app from sun app server 8 tutorial sdk 1.4 to use mutual auth. I present deployment descriptors generated by deploytool.
This is sun-web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Sun ONE Application Server 8.0 Servlet 2.4//EN" "http://www.sun.com/software/sunone/appserver/dtds/sun-web-app_2_4-0.dtd">
<sun-web-app>
<context-root>/bookstore2</context-root>
<security-role-mapping>
<role-name>appuser</role-name>
<principal-name>admin</principal-name>
</security-role-mapping>
<resource-ref>
<res-ref-name>jdbc/BookDB</res-ref-name>
<jndi-name>jdbc/BookDB</jndi-name>
<default-resource-principal>
<name>PBPUBLIC</name>
<password>PBPUBLIC</password>
</default-resource-principal>
</resource-ref>
<cache enabled="false" max-entries="4096" timeout-in-seconds="30">
<default-helper/>
</cache>
<jsp-config>
<property name="keepgenerated" value="true"/>
</jsp-config>
</sun-web-app>
This is web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
<display-name>bookstore2</display-name>
<context-param>
<param-name>javax.servlet.jsp.jstl.fmt.localizationContext</param-name>
<param-value>messages.BookstoreMessages</param-value>
</context-param>
<listener>
<listener-class>listeners.ContextListener</listener-class>
</listener>
<servlet>
<display-name>Dispatcher</display-name>
<servlet-name>Dispatcher</servlet-name>
<servlet-class>dispatcher.Dispatcher</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>Dispatcher</servlet-name>
<url-pattern>/bookstore</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Dispatcher</servlet-name>
<url-pattern>/bookcatalog</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Dispatcher</servlet-name>
<url-pattern>/bookdetails</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Dispatcher</servlet-name>
<url-pattern>/bookshowcart</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Dispatcher</servlet-name>
<url-pattern>/bookcashier</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Dispatcher</servlet-name>
<url-pattern>/bookordererror</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Dispatcher</servlet-name>
<url-pattern>/bookreceipt</url-pattern>
</servlet-mapping>
<jsp-config>
<jsp-property-group>
<display-name>bookstore2</display-name>
<url-pattern>*.jsp</url-pattern>
<el-ignored>false</el-ignored>
<scripting-invalid>false</scripting-invalid>
<is-xml>false</is-xml>
<include-prelude>/template/prelude.jspf</include-prelude>
<include-coda>/template/coda.jspf</include-coda>
</jsp-property-group>
</jsp-config>
<security-constraint>
<display-name>SecurityConstraint</display-name>
<web-resource-collection>
<web-resource-name>WRCollection</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>TRACE</http-method>
<http-method>DELETE</http-method>
<http-method>POST</http-method>
<http-method>OPTIONS</http-method>
<http-method>HEAD</http-method>
<http-method>GET</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>appuser</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>CLIENT-CERT</auth-method>
</login-config>
<security-role>
<role-name>appuser</role-name>
</security-role>
<resource-ref>
<res-ref-name>jdbc/BookDB</res-ref-name>
<res-type>javax.sql.DataSource</res-type>
<res-auth>Container</res-auth>
<res-sharing-scope>Shareable</res-sharing-scope>
</resource-ref>
</web-app>
Using these I can't login.
It is because I don't have an option to specify a user when I login.
Qustions:
1. How to change the application so it uses only client-cert (without users and passwords)
2. How to change the application so login is possible with client-cert with specified user - admin?
(my first guess - do form auth then client-cert, client-cert -> form login not possible ?)
3. Are the certificated bound to specyfic application server users ?
Thanks.