java client certificate authentication

Question

I implemented a strong authentication in a web server (apache) and it work great. but I want to implement a java class that have to compare cac ID and suject name to the ones presents on java .properties file or XML

Cratylus · Accepted Answer · 2012-09-11 19:36:36Z

3

Not sure about your deployment but for example if you need to do that from a servlet deployed in Tomcat you could do:

X509Certificate[] certs = (X509Certificate[])request.getAttribute("javax.servlet.request.X509Certificate");

If the client has send certificates then certs will have them and you can do the check you need and possibly reject according to your needs.
Note that this will happen after the SSL handshake has finished.

answered Sep 11, 2012 at 19:36

Cratylus

54.3k73 gold badges222 silver badges348 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

xfocus Over a year ago

how can i manage or detect smart card removal event? and how to disconnect the client after.

Cratylus Over a year ago

@xfocus:You did not mention this in the OP.And I don't know how you could detect this.Depends on your client program?

xfocus Over a year ago

my middleware application(gemalto classic client) can detect and remove client certificate from personnal certificate store,after the card is removed,but i don't know how to take advantage of that.

Cratylus Over a year ago

@xfocus:Perhaps send a message to server to indicate this happened?

xfocus Over a year ago

i don't realy know how to do that.cose the classic client only remove the client certificate so how the server will be informed?

|

Collectives™ on Stack Overflow

java client certificate authentication

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related