Craig McClanahan
[EMAIL PROTECTED] wrote:
Hi StefanI try to extract certicate to my request like you say in your mail but I have
an exception because object return by request.getAttribute( "javax.servlet.request.X509Certificate" )
method wasn't type of java.security.cert.X509Certificate but [Ljava.security.cert.X509Certificate;log file :
2000-12-13 16:21:10 StandardWrapperValve[org.apache.catalina.INVOKER.SnoopServlet]: Servlet.service() for servlet org.apache.catalina.INVOKER.SnoopServlet threw exception
java.lang.ClassCastException: [Ljava.security.cert.X509Certificate;
at SnoopServlet.doGet(SnoopServlet.java:65)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:740)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at org.apache.catalina.core.ApplicationFilterWrapper.doFilter(ApplicationFilterWrapper.java:159)
at filters.ExampleFilter.doFilter(ExampleFilter.java:136)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:258)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:936)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:160)
at org.apache.catalina.valves.ValveBase.invokeNext(ValveBase.java:242)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:311)
at org.apache.catalina.valves.ValveBase.invokeNext(ValveBase.java:242)
at org.apache.catalina.valves.CertificatesValve.invoke(CertificatesValve.java:152)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:934)
at org.apache.catalina.core.StandardContext.invoke(StandardContext.java:1674)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:161)
at org.apache.catalina.valves.ValveBase.invokeNext(ValveBase.java:242)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:343)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:934)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:159)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:936)
at org.apache.catalina.connector.http.HttpProcessor.process(HttpProcessor.java:787)
at org.apache.catalina.connector.http.HttpProcessor.run(HttpProcessor.java:904)
at java.lang.Thread.run(Thread.java:484)Very strange but are you an idea about my problem?
Config : Apache Tomcat (v4.0-m1)
Jérôme
Stefán F. Stefánsson <[EMAIL PROTECTED]> 04/12/00 10:53
Veuillez répondre à tomcat-dev
Pour : <[EMAIL PROTECTED]>
cc :
Objet : RE: X509 client certificate
Hi Alexandre.
I'm not sure I fully understand your question but let me see if I can
help you at all.The addSecureEndpoint method of EmbededTomcat used to be just like the
one you described below. I added the addSecureEndpoint(int port,
InetAddress addr, String hostname, String keyfile, String keypass,
boolean clientAuth) to be able to force the client to show a certificate
for logging in.I want to answer you in a few steps, so please bear with me.
1.
Now, first of all I think you're going a little bit too long of a way
using the addSecureEndpoint. Wouldn't it be easier for you to call the
method I described above (the addSecureEndpoint(int, InetAddress,
String, String, String, boolean)) instead of calling the original one
(the addSecureEndpoint(int, InetAddress, String, String, String)) and
changing the code in that? The modifications to the original
addSecureEndpoint were for backwards compatability. In other words, the
original method, addSecureEndpoint added an endpoint with no client
authentication. I added a method that provides means for getting client
authentication by the means of client certificates, and modified the
original call to call my method with client authentication == false.
Hence, maintaining backwards compatability. I would say you should much
rather change the code in tomcat to what it was before and call
addSecureEndpoint(int, InetAddress, String, String, String, boolean) in
EmbededTomcat directly instead. That way you won't have to recompile
Tomcat every time you change your mind about requiring a client
certificate in your application.2.
Now for your problem at hand ;o). I don't know exactly how the
getUserPrincipal method in HttpServletRequest class is supposed to work
but what I got from JavaDoc was:Returns a java.security.Principal object containing the name of the
current authenticated user. If the user has not been authenticated, the
method returns null.And from the JavaDoc for java.security.Principal, I got:
This interface represents the abstract notion of a principal, which can
be used to represent any entity, such as an individual, a corporation,
and a login id.Now. You would think that Tomcat should serve up the DN of the client
certificate when a user calls request.getUserPrincipal but according to
you, it doesn't. I don't know if there are any reasons for that
although I doubt it. I would think this is an oversight and should
prefferably be fixed. That shouldn't be too much trouble. The
ServletAPI Specs are not all that clear about this issue. I would think
that getUserPrincipal works for other types of authentication (the
username, password type). I'll file in a bug report on this matter
after I finish this ;o)Now for your solution. What you can do is call the method
request.getAttribute( "javax.servlet.request.X509Certificate" ). This
will return a java.security.cert.X509Certificate with all the
information you could possibly want (well... almost) on your client.
This include the distinguished name of the client by using
java.security.cert.X509Certificate.getSubjectDN().I hope this helps!
Regards, Stefan.
-----Original Message-----
From: Alexandre A. Drummond Barroso
[mailto:[EMAIL PROTECTED]]
Sent: 3. desember 2000 00:16
To: [EMAIL PROTECTED]
Subject: X509 client certificate
I tried to make Tomcat
changing the following parameter of addSecureEndpoint in
src/share/org/apache/tomcat/startup/EmbededTomcat.java:public void addSecureEndpoint( int port, InetAddress addr, String
hostname,
String keyFile, String keyPass )
{
addSecureEndpoint(port, addr, hostname, keyFile, keyPass,
false);
^^^^^
to true, but when I called request.getUserPrincipal() it just returned
null. Is there any problem with addSecureEndpoint
implementation or in some method it calls?Regards,
Alexandre
