Needing a serializable principal is a bad sign; from this I assume that you are using the beans through the remote interfaces; If you accessed the beans using local calls there would be no need for serialization.
Client-cert authentication relies on the SSL handshake to verify the presented certificate so it is only secure in the local context of the connection - any extension to thirdparties relies on trust relationships which should be carefully examined for security holes (for instance if the remote login is just fowarding the principal and credential you must accept connections only from trusted sources as otherwise clients can just supply the principal and the certificate (= PUBLIC key) to authenticate as anyone they choose. Also for the least problems the web application and the EJB should be in the same security domain (or at least both in a certificate login domain; normally a JaasSecurityDomain with appropriate login modules). Assuming that you are sure that you need the serializable principal, in the deploy/jbossweb-tomcat50.sar/server.xml file: certificatePrincipal is the mapping class name. This class must implement the interface org.jboss.security.CertificatePrincipal which has one method: public java.security.Principal toPrinicipal(java.security.cert.X509Certificate[] certs); The built in JBoss class SubjectDNMapping in the config above uses the build in method to get a Principal: certs[0].getSubjectDN(); There is another built in class for mapping, SerialNumberIssuerDNMapping, which uses the following logic: BigInteger serialNumber = certs[0].getSerialNumber(); Principal issuer = certs[0].getIssuerDN(); SimplePrincipal principal = new SimplePrincipal(serialNumber+" "+issuer); SimplePrincipal is serializable, so the get a serializable principal either specify this class in the config above, or use you own implementation of the interface. When the JBossSecurityMgrRealm has created the principal it uses the assigned security domain (from the web app config) to login using the created principal with the certificate chain as a credential, which is then passed to the configured login modules. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3840228#3840228 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=3840228 ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ JBoss-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-user
