1

The question here is that how can we enforce tomcat server to verify that the smart card is still present while any api is being hit. Or how to enforce renegotiation of SSL along with pin verification once the card is removed.

I'm working on an application and use Tomcat as server. I have to authenticate users through smart cards. So when the user hits the web application, the browser asks to choose certificate and asks for pin for that smart card.

The above functionality is working fine. Now the scenario is that whenever the smart card is removed, the Tomcat server should know of its removal, and ask to choose the certificate and verify pin again.

I have tried below different codes on logout API call, but nothing seems to work:

Code 1:

sc = SSLContext.getInstance("SSL");
int i = sc.getServerSessionContext().getSessionTimeout();
sc.getServerSessionContext().setSessionTimeout(0);

Code 2:

Object sslSessionMgr = paramHttpServletRequest.getAttribute("javax.servlet.request.ssl_session_mgr");
//SSLSessionManager sslSessionMgr = (SSLSessionManager) paramHttpServletRequest.getAttribute("javax.servlet.request.ssl_session_mgr");
if (sslSessionMgr != null) {
    try {
        Method invalidateSession =   Class.forName("org.apache.tomcat.util.net.SSLSessionManager").getMethod("invalidateSession");
        invalidateSession.setAccessible(true);
        invalidateSession.invoke(sslSessionMgr);
        SSLSessionManager a =  (SSLSessionManager) sslSessionMgr;
        a.invalidateSession();
        paramHttpServletResponse.setHeader("Connection", "close");
    } catch (Exception e) {
        e.printStackTrace();
    }
}

Code 3: Cookie removal

if (paramHttpServletRequest.getCookies() !=null && paramHttpServletRequest.getCookies().length > 0) {
    for (Cookie cookie : paramHttpServletRequest.getCookies()) {
        if (cookie.getName().equals("JSESSIONID")) {
            cookie.setMaxAge(0);
            Calendar.getInstance();
            paramHttpServletResponse.setHeader("Set-Cookie", "JSESSIONID="+cookie.getValue()+";path=/capehenry;Secure;HttpOnly;expires = Friday, 04-Feb-07 22:03:38 GMT;");
        }
    }
}

Code 4:

httpSession.setMaxInactiveInterval(1);

Please suggest how to resolve this issue.

Sadeq Dousti
  • 3,346
  • 6
  • 35
  • 53
Swati Joshi
  • 105
  • 3
  • 14

0 Answers0