Hi Jerome,
Bruno told me (thanks for the detailed answer, Bruno) that I need to
request the HttpServltRequest to check, which authentication scheme is
used. So I reason, that it is not supported by Restlet now. Right?
Are there some plans to support this? A solution could be to copy the
authentication scheme in the request attributes with a given key.
best regards
Stephan
Bruno Harbulot schrieb:
Hi Stephan,
If the request was authenticated using a client certificate, the
following will be non-null:
List<X509Certificate> certificates =
(List<X509Certificate>)getRequest().getAttributes().get("org.restlet.https.clientCertificates");
I believe this should now work with all types of HTTPS connectors in
Restlet, included behind AJP or with a Servlet (if not, please let me
know and/or fill in a bug report).
I assume the JAX-RS specification follows the Servlet specification
and the ('auth-constraint' configuration element).
However, in principle, client-side SSL authentication and BASIC/DIGEST
(or even FORM) autentication are orthogonal. You could required both
client-certificate authentication and either of BASIC, DIGEST or FORM.
(It's probably not very sensible in practice).
You would also have to configure the server SSL connector to use at
least "wantClientAuthentication" if not "needClientAuthentication".
I don't really use Restlet with the Servlet connector, so I'm not
sure, but I don't think it's currently possible to check whether FORM
authentication has been used (as a matter of fact, I'm not sure
whether it's possible to check whether BASIC or DIGEST authentication
has been used when using the Servlet connector). To do so, I would
imagine that a call to getRequest().getAuthType (the request here
being an HttpServletRequest) would be required somewhere in
com.noelios.restlet.ext.servlet.ServletCall, or nearby.
Best wishes,
Bruno.
Stephan Koops wrote:
Hi Bruno and all,
JAX-RS has a method in the API, where the application developer could
request, which authenticaton scheme was used
(SecurityContext.getAuthenticationScheme(), if someone is interested)
If the request was authenticated by BASIC, DIGEST, client certificate
or Servlet form authentication, I have to return a given constant for
them.
Check for BASIC and DIGEST is easy, but how can I check, if the
request was authenticated by SSL client certificate? And how can I
check, if it was Servlet form authentication?
best regards
Stephan
