HttpServlet-如何知道是否使用SSL客户端身份验证

Question

I have a Servlet container (Glassfish/OC4J) which service some JAX-WS web service endpoints which can be reach using HTTPS. The SSL is configured to support both Client Authentication and Server only authentication (like client-auth="want" on Glassfish).

In my endpoint implementation I want to know if the connection was done with or without Client authentication. I already have access to the HttpServletRequest object, but the getAuthType() method is always returning null, no mater if Client auth is done or not (checked using wireshark to be sure it does what I want).

Does anybody knows how to have access to such info ?

Thanks a lot

Answer 1

The javax.servlet.request.X509Certificate request attribute should return an array of java.security.cert.X509Certificate .

You can get it from your request using:

X509Certificate[] certs = req.getAttribute("javax.servlet.request.X509Certificate");

If non-null, and if it contains something, the first element ( certs[0] ) will be the client certificate itself. There may be other elements in this array, which will contain intermediate CA certificates (what's presented by the client can be a certificate chain), where cert[i] is issued by cert[i+1] .