[RAMPART-412] SSL mutual Authentication failed when Require SSL policy configured with the Client Certificate Required as true.

• Type: Question
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.6.2
• Component/s: rampart-policy
• Assignee: Unassigned
• Reporter: Madhavan Kidambi
• Created: 03/Mar/14 07:11
• Updated: 03/Mar/14 07:11

Description

Hi,
When we configure a service with Require HTTPS and Client certificate required RamartUtil of version 1.6 does the following check at under validateTransport( Line 1835)

if (((HttpsToken) rpd.getTransportToken()).isRequireClientCertificate()) {
MessageContext messageContext = rmd.getMsgContext();
HttpServletRequest request = ((HttpServletRequest) messageContext.getProperty(HTTPConstants.MC_HTTP_SERVLETREQUEST));
if (request == null || request.getAttribute("javax.servlet.request.X509Certificate") == null) {
throw new RampartException("clientAuthRequired");
}
}

Our question is now
1. How to validate Non-servlet requests i.e HTTPConstants.MC_HTTP_SERVLETREQUEST is not set.
Since because of this the policy valdiation always fails even before the valid Client certificate validation happens.
2. Can we know the reason for adding such a validation