通过Java应用程序使用Apache进行证书认证和授权

Question

I have an Apache server that handles authentication and authorization before forwarding requests to a second server.

Users accessing the server from a browser are authenticating with LDAP and the authorization checks to see that username is present within a defined file.

I also have a Java application that can access the server (at a different endpoint), which currently hardcodes a username and a password into a request URL and leverages Basic Authentication over SSL.

Rather than use Basic Authentication, is it possible to configure Apache to accept a keystore/truststore from the Java application and authenticate/authorize on the certificate's CN and a password? If so, can anyone cite an example?

Answer 1

You can configure Apache to request client certificate authentication and use +FakeBasicAuth SSLOption in order to preserve compatibility with your current setup.

If the Java application can be restrained to certain URLs then you can require certificate authentication, otherwise make it optional as you do not want your other clients to have to authenticate with certificates.

There are good examples of this in the SSL/TLS - How-To in the Apache documentation.