<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Ade,<br>
<br>
Your ealier emali discussed the renegotiation challenge based on the
Profiles. <br>
<br>
<a class="moz-txt-link-freetext" href="http://pki.fedoraproject.org/wiki/REST#Profiles">http://pki.fedoraproject.org/wiki/REST#Profiles</a><br>
<br>
For the case where a user points a browser (say and Ajax request)
at /pki/profiles lets say that we have two cases: one where the
user is authenticated and one where they are not. In both cases,
they get back a collection, but in the case of unauthenticated it
will have significantly fewer entries. <br>
<br>
In this case, we would want the Java equivalent of mod_nss: <br>
<br>
NSS_VerifyCLient: Optional<br>
<br>
I'm guessing this a tomcatjss setting.<br>
<br>
In this case, if the user has the certificate, they can present it,
but if they don't, the operation will complete. I think this is
what we want. We always ask for the certificate, but we say it is
OK if you don't have it, you just don't get the data.<br>
<br>
In the case where the user is asking for an object, say an actual
profile, and they don't have sufficient privs, they get back a hard
and fast error: probably 403.2 <br>
<br>
<a class="moz-txt-link-freetext" href="http://en.wikipedia.org/wiki/HTTP_403">http://en.wikipedia.org/wiki/HTTP_403</a><br>
<br>
For something like CSRs, we probably want to restrict access to
agents. In that case, if an unauthenticated user, or one without
appropriate privs, attempts to access that URL, they also get a
403.2.<br>
<br>
I don't know how this works in with the renegotiate, but I am
guessing that every time the user without a certificate hits an
"Optional" page they will be asked for their cert. This might be
chatty. No idea.<br>
<br>
So in general, we tag the URLS either <br>
NSS_VerifyClient: Require if they must be authenticated to use them<br>
NSS_VerifyClient: Optional if they see different results based on
authentication or not<br>
NSS_VerifyClient: None if they can view them unauthenticated and see
the same results as everyone else<br>
<br>
<br>
IN the pki/WEB-INF/web.xml, this probably maps to something like
this:<br>
<pre><security-constraint>
<web-resource-collection>
<web-resource-name>Protected Resource</web-resource-name>
<url-pattern><b>/*/profile</b></url-pattern>
</web-resource-collection>
</pre>
<pre> <auth-constraint>
<role-name><b>anonymous</b></role-name>
<role-name><b>agent</b></role-name>
</auth-constraint>
</security-constraint></pre>
<br>
I'm guessing that we want to specify a role for anonymous as opposed
to no role. <br>
<br>
<pre><web-app>
...
<login-config>
<auth-method>CLIENT-CERT</auth-method>
<realm-name>Tomcat Manager Application</realm-name>
<realm-name>PKICA</realm-name>
</login-config>
...
</web-app></pre>
<br>
<br>
the PKICA Realm would be defined at the server level, in
conf/server.xml. Something like:<br>
<br>
<br>
<img alt="" src="cid:part1.03000705.08000008@redhat.com" height="1"
hspace="0" vspace="0" width="1" border="0">
<pre><Realm className="com.netscape.catalina.realm.LDAPCertRealm"
connectionURL=<a class="moz-txt-link-rfc2396E" href="ldaps://localhost:8389">"ldaps://localhost:8389"</a>
userPattern="uid={0},ou=people,dc=mycompany,dc=com"
roleBase="ou=groups,dc=mycompany,dc=com"
roleName="cn"
roleSearch="(uniqueMember={0})"
/>
</pre>
There is a class that almost does what we want.<br>
<br>
<b>org.apache.catalina.realm.JNDIRealm</b>. <br>
<br>
I suspect we can subclass it. It has two ways of doing the auth :
Bind mode and Comparison mode. It might be possible to add a
Client Cert mode in a subclass. docs are here:<br>
<a class="moz-txt-link-freetext" href="http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html#JNDIRealm">http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html#JNDIRealm</a><br>
<br>
<br>
<br>
<br>
</body>
</html>