Is there a way to restrict access to a website based on ssh keys? Exactly the same way ssh works:
- If you have a key, access granted — no password
- If you don’t have a key, access denied
If not, what is the best alternative that would satisfy the above conditions? Would I be better off using htuser? I can’t restrict access based on IP addresses because the people accessing the site will most likely not always have the same IP.
Sure, using Mutual-SSL-Authentication you can secure your website using SSL certificates.
I don’t know your environment, but here’s a pretty detailed writeup on how to perform mutual authentication on Tomcat.