Question

I have a scenario where we are developing an app with both a Business to Customer interface, and a Business to Business interface.

The B2B interface is a RESTful interface to modify resources that the B2C interface manipulates through a bunch of nice friendly interfaces.

Because the B2B interface allows access to more functionality than the B2C interface, it’s a requirement that the B2B interface use Mutual Certificate authentication.

Our target environment/stack is Apache => Tomcat => Grails => Irrelevant Infrastructure

My current research indicates that Apache will be doing the authentication, and then passing auth details on to Tomcat? Is this the case? I’ve been looking at the spring-security-plugin which seems to provide what we want, and I’m confident we could provide either option on its own.

I just haven’t seen any discussion around configuring multiple different authentication mechanisms.

Note: I’m not after fallback auth. If you can’t access B2B via Mutual Certificate auth there should not be the option to use basic auth

Answer 1

Yes, you can. There are 2 solutions:

1. First solution

The trick here is to configure Apache to ask for client authentication, but not require it. It’s configured like this in your Apache configuration:

<VirtualHost mysite:443>

  //usual SSL VHost config

  SSLVerifyClient optional


  RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"
  RequestHeader set SSL_CLIENT_I_DN "%{SSL_CLIENT_I_DN}s"
  RequestHeader set SSL_SERVER_S_DN_OU "%{SSL_SERVER_S_DN_OU}s"
  RequestHeader set SSL_CLIENT_VERIFY "%{SSL_CLIENT_VERIFY}s"

  ProxyPass          http://localhost:50161/path_to_protect
  ProxyPassReverse   http://localhost:50161/path_to_protect

</VirtualHost>

At the application level, you have to check that for the sensitive paths, Apache provides a certificate by checking the header. Alternatively, you can also do this access control at Apache level (via tags).
For the non-sensitive paths, you can configure your application to ask for login/passwords.

2. Second solution

You can declare two VirtualHosts in Apache: one that is configured with SSLVerifyClient require and that allow access to your sensitive path, one that is configured with SSLVerifyClient optional and that allow access only to your non-sensitive path.