Announcement

Collapse
No announcement yet.
X
  • Filter
  • Time
Clear All
new posts

    Does the HttpProxyServlet support certificate based authentication?

    I am attempting to use the HttpProxyServlet to proxy a request to a service that requires TLS authentication with a client certificate. It appears that the credentials are not being passed like I would expect. Is this supported?

    Code:
    import com.smartgwt.client.rpc.RPCCallback;
    import com.smartgwt.client.rpc.RPCManager;
    import com.smartgwt.client.rpc.RPCRequest;
    import com.smartgwt.client.rpc.RPCResponse;
    import com.smartgwt.client.types.RPCTransport;
    
    ...
    
    RPCRequest request = new RPCRequest();
    request.setActionURL(<SOME URL GOES HERE>);
    request.setHttpMethod("GET");
    request.setUseHttpProxy(true);
    request.setHttpHeaders(<MY ACCEPT HEADERS>);
    request.setWithCredentials(true); //I thought this might send the client auth certificates...
    request.setTransport(RPCTransport.XMLHTTPREQUEST);
    RPCManager.sendProxied(request, new RPCCallback() {
        @Override
        public void execute(RPCResponse rpcResponse, Object o, RPCRequest rpcRequest) {
            <HANDLE THE RESPONSE>;
        }
    });
    SmartClient Version: v11.1p_2020-01-09/Enterprise Deployment (built 2020-01-09)
    Firefox 74.0

    #2
    Certs aren't a part of the HTTP request per se, but something negotiated prior to it, so there's no way to really pass one through a proxy.


    Options are:

    1. do a direct request, perhaps via configuring the target site to allow this, or using scriptInclude transport, if that's feasible

    2. set up your Java server to have the cert, if that's appropriate. See this StackOverflow response for some details and background:

    https://stackoverflow.com/questions/...authentication

    Since we're using the HttpClient library within our HttpProxyServlet, if the cert is configured as above, it'll be used automatically.

    Comment

    Working...
    X