Spring 3 and X.509 Authentication

[Jason Ferguson]

I'm trying to write an web application that takes advantage of X.509 authentication. I want to make sure I am straight on what needs to be done.

First, in my applicationContext.xml file, I need to add the following lines:

    
<security:http>
        <security:x509 subject-principal-regex="CN=(.*?)," user-service-ref="userService"/>
    </security:http>

On the database, I need to have populated User and Authorities tables. The username in the User table needs to be the CN from the X.509 certificate.

Next, I need a model/value object which implements UserDetails.

Next I need to implement UserDetailsService.

Once all of this is done, the SecurityContext will contain an Authentication object.

I then go back to the applicationContext.xml and set up the authorities by adding this line (and others) to the

 <security:http>  

section:

 <security:intercept-url pattern="/admin/**" access="ROLE_ADMIN" />    

It just seems a bit too easy, and I'm still scarred from a failed attempt to do this from the ACEGI days.

Jason

[Peter Mularien]

Hi Jason,

I actually devote a whole chapter in the book to X.509 (client certificate) authentication. I would say that the majority of the issues / confusion around X.509 authentication tend to be more around the lifecycle and correct management and installation of certificates, server trust stores, etc. and not so much the configuration of Spring Security 3 itself.

It looks from the below code as though you are on the right track, though!

Best
Peter