Regular and Client-authenticated HTTPS?

Question

Hello guys,
I am having trouble editing the deployment descriptor. This is the first time I deal with HTTPS, and I have tried to solve my problem by reading documentation on my own (namely, the servlet specification 2.4).
I am developing a web application to be run on Tomcat 6 with JRE 6. I need to secure my application; certain parts need to be accessed via regular HTTPS (i.e. without client-certificate authentication); other parts need to be accessed via client-certificate authenticated HTTPS. I am not all that sure if I am modifying my web.xml correctly. I also want to restrict the access method to POST (i.e. I want to deny GET requests to these pages).
Right now, I have added the following to my web.xml:
<security-constraint>
     <web-resource-collection>
          <web-resource-name>client-certificate authenticated pages</web-resource-name>
          <url-pattern>*.cca</url-pattern>
          <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
          <role-name>cca_user</role-name>
     </auth-constraint>
     <user-data-constraint>
          <transport-guarantee>CONFIDENTIAL</transport-guarantee>
     </user-data-constraint>
</security-constraint>
<security-constraint>
     <web-resource-collection>
          <web-resource-name>regular https pages</web-resource-name>
          <url-pattern>*.rh</url-pattern>
          <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
          <role-name>rh_user</role-name>
     </auth-constraint>
     <user-data-constraint>
          <transport-guarantee>CONFIDENTIAL</transport-guarantee>
     </user-data-constraint>
</security-constraint>As you can probably notice, the two instances of <security-constraint> are almost identical. So here are the problems:
1. Something must be missing before the difference between client-certificate-authenticated https and regular https is established.
2. Since I want to force the use of client-certificate-authenticated https on requests to *.cca, I must let the application server know which client identity I am expecting. I still have no clue how to do that.
3. I put <http-method>POST</http-method> in both instances of <security-constraint>, but I doubt it does what I mean it to do. It probably means to apply the security constraint only if the matching URLs are accessed via POST (i.e. no security is required when these pages are accessed via GET). This is not the behaviour that I want.
Can somebody help me with the above problems?
Edited by: SwordAngel on Jul 30, 2008 4:15 AM

Answer 1

Hi Jacob,
Take a look at the simple, one way SSL example [1] however it sounds
like you want to have the client provide a cert back to the server,
implying two-way SSL. You can find a two-way example here [2].
Regards,
Bruce
[1]
http://webservice.bea.com/simpleSSL.zip
[2]
http://webservice.bea.com/SSL2way.zip
Jacob Anderson wrote:
>
Got some web services that are document and document wrapped. Have generated the
client stubs using <clientgen> ANT task from BEA. Time to run a test against
the web services, but they have to run on HTTPS. When I invoked my web service
using the HTTPS://.... URL, I got this:
[java] 5) testQuoteStubs(com.arrow.arrowsoap.client.QuoteServiceClientTest)
weblogic.webservice.tools.wsdlp.WSDLParseException: Failed to retrieve WSDL from
https://localhost:7002/QuoteService?WSDL. Please check the URL and make sure
th
at it is a valid XML file [javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIF
ICATE - A corrupt or unuseable certificate was received.]
Cool. So how do I assign a default CERT to the https client? This is on a developer
instance of WL 8.1. I don't want to run the test on HTTP b/c I need to see how
it works with HTTPS (need to simulate a bona fide downstream user). Any help
is greatly appreciated.
Thanks
-Jake