Glassfish 3.1.2 configuration Client Certificate for Mutual Authentication

Question

I need help in configuring GF3.1.2 i have done following changes, please do let me know if i am missing anything important as after changes it is NOT working. my id is niles

Answer 1

Set

Client Authentication: true

in http-listener-2.

Answer 2

The login-config section is incomplete in your web.xml

<login-config>
    <auth-method>CLIENT-CERT</auth-method>
    <realm-name>certificate</realm-name>
</login-config>

The realm-name content must match the name attribute of auth-realm element in domain.xml, which in your case is "certificate"

[updated]

In addition, the CA certificate must be imported in the server's truststore

${com.sun.aas.instanceRoot}/config/cacerts.jks

Answer 3

Actually I tries on glassfish 3.1.2 and it worked under following conditions:

1.I have to use the same key(trust) store of jks type and in the same location. In order to talk with other certificate formats you have to convert them to format jks format can handle.

2.in a glassfish-web.xml you should have like this mapping

    <security-role-mapping>
      <role-name>manager</role-name>   
    <group-name>authorized</group-name>
    </security-role-mapping>

3.in a domain.xml file you should have the followings:

<auth-realm classname="com.sun.enterprise.security.auth.realm.certificate.CertificateRealm" name="certificate">
              <property name="assign-groups" value="authorized"></property>
            </auth-realm> 

Note: in web.xml you have to have realm name matching domain.xml file

Answer 4

When anyone will try this first time it will take time for them to understand, withing simple words, both client and server trust-stores should trust each other certificates, first it is better to use Self-signed certificates exchange certificates to server and client, one can use following article for help which has simplified steps. follow article then you can use your own methods certificates which ever u want.

http://www.slideshare.net/krizsan/scdjws-5-study-notes-3085287

SCDJWS 5 or nowadays know as Oracle Certified Professional, Java EE 5 Web Services Developer Study Notes by Ivan A Krizsan Version: February 23, 2012