Search code examples
javatomcatsslbasic-authenticationclient-certificates

Is Tomcat capable of using mixed Authentication on one app (BASIC and CLIENT-CERT)?

Is it possible to secure resources of an web-application with tomcat (v. >6) using different auth-methods:

  • BASIC
  • CLIENT-CERT

I have a webapp, where some resources can be secured just using BASIC Auth. Example for Basic:

  • myApp/userInterface/*

But for some resources which are exposed as services I want to use Client-Cert Authentication. Example for Client-Cert:

  • myApp/api/*

Until now I have only found possiblities to do this per web-app in the web.xml but not on resource level.

Solution

  • There is no way to configure Tomcat to do this out of the box. It might be possible with 3rd party authentication libraries.