[JAMES-3672] TLS authentication via client certificate

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Done
• Affects Version/s: master
• Fix Version/s: 3.7.0
• Assignee: Unassigned
• Reporter: Karsten Otto
• Created: 16/Nov/21 09:44
• Updated: 26/Nov/21 04:42
• Resolved: 26/Nov/21 04:42

Description

In order to limit access to trusted partners/users only, James should support TLS with certificate-based client authentication.

For this purpose, TLS configuration is extended with the desired authentication mode (none, optional, required), and the associated trust store to validate any received client certificates. Example:

<tls socketTLS="true" startTLS="false">
  <keystore>file://conf/keystore</keystore>
  <keystoreType>JKS</keystoreType>
  <secret>yoursecret</secret>

  <clientAuth required="true">
    <truststore>file://conf/truststore</truststore>
    <truststoreType>JKS</truststoreType>
    <truststoreSecret>yoursecret</truststoreSecret>
  </clientAuth>
</tls>

This is implemented mostly in AbstractConfigurableAsyncServer and associated Netty infrastructure.

T-Shirt size M.

Issue Links

• links to: GitHub Pull Request #750