Tomcat中基于数据库的SSL客户端身份验证

Question

I would like to know if it is possible to have a more dynamic way to handle with client certs than edit tomcat-users.xml ? and how to do it ?

A database way would be much better in order add new certs or revoke since now i have to restart the server everytime I need to add a new one in tomcat-users.xml.

best regards

Answer 1

There are multiple ways to do the things dynamically. It depends on your project environment that, which way you want to use.

1. First is JRebel tool, which is used to change the config files without rebooting server. http://zeroturnaround.com/software/jrebel/

2. You can manually implement the listeners which will listen for the changes happen to particular file using dynamic class loading. http://tutorials.jenkov.com/java-reflection/dynamic-class-loading-reloading.html

There may be other ways also.! But I think from these you can achieve what you want.

Answer 2

You can use the JDBCRealm to get the user authorizations after authenticating him with his client cert.

See Can CLIENT-CERT auth-method be used with a JDBC realm within tomcat? for details.