Uploaded image for project: 'Rampart'
  1. Rampart
  2. RAMPART-412

SSL mutual Authentication failed when Require SSL policy configured with the Client Certificate Required as true.

    XMLWordPrintableJSON

Details

    • Question
    • Status: Open
    • Major
    • Resolution: Unresolved
    • 1.6.2
    • None
    • rampart-policy
    • None

    Description

      Hi,
      When we configure a service with Require HTTPS and Client certificate required RamartUtil of version 1.6 does the following check at under validateTransport( Line 1835)

      if (((HttpsToken) rpd.getTransportToken()).isRequireClientCertificate()) {
      MessageContext messageContext = rmd.getMsgContext();
      HttpServletRequest request = ((HttpServletRequest) messageContext.getProperty(HTTPConstants.MC_HTTP_SERVLETREQUEST));
      if (request == null || request.getAttribute("javax.servlet.request.X509Certificate") == null) {
      throw new RampartException("clientAuthRequired");
      }
      }

      Our question is now
      1. How to validate Non-servlet requests i.e HTTPConstants.MC_HTTP_SERVLETREQUEST is not set.
      Since because of this the policy valdiation always fails even before the valid Client certificate validation happens.
      2. Can we know the reason for adding such a validation

      Attachments

        Activity

          People

            Unassigned Unassigned
            mki Madhavan Kidambi
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated: