users@glassfish.java.net

Re: SSL Client certs -- requested but not enforced?

From: Jan Luehe <Jan.Luehe_at_Sun.COM>
Date: Tue, 11 Aug 2009 17:53:04 -0700

On 08/11/09 07:14, glassfish_at_javadesktop.org wrote:
> Thanks allot! I'm not sure I can use EE6 authenticate() as I want to be app server portable as possible. I do have full control over the java thick clients, however; is there any way for the client to force glassfish to accept a client cert?
>
> For example, if I use SSLSocket.setNeedClientAuth(true) will that force the server to do it?
>

See
http://java.sun.com/javase/6/docs/api/javax/net/ssl/SSLSocket.html#setNeedClientAuth(boolean)

  Configures the socket to require client authentication. This option
  is only useful for sockets in the *server* mode.

In other words, you can't force client auth from a client SSLSocket.

Jan


> [Message sent by forum member 'suggarglider' (suggarglider)]
>
> http://forums.java.net/jive/thread.jspa?messageID=359911
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe_at_glassfish.dev.java.net
> For additional commands, e-mail: users-help_at_glassfish.dev.java.net
>
>