[jboss-user] [Security & JAAS/JBoss] - Problem - if USB Token is removed, web application must not

[ensoreus]

Hi,

     I'm using JBoss 4.2.2.GA for a J2EE web application, running on a secured VPN. The application must all be SSL-enabled and the users accesing it must have an USB eToken Pro (with their client certificate on it). The application runs on Internet Explorer 7 (client requirement).

If the user removes the usb token the web application must not allow any other operation.  If I run the application on Firefox 3, remove the token and then try to continue with the application an error message appears:

anonymous wrote : Secure Connection Failed
  | PKCS#11 token was inserted or removed while operation was in progress.
  | (Error code: ssl_error_token_insertion_removal)

Internet Explorer 7 doesn't have the same behavior if I remove the token.
On IE7 the application behaves the same even if I remove the token.

Can someone give me some advice on how to configure this behavior on JBoss (when the user removes the token, the application must not be accessible anymore) ? How can I enforce client certificate authentication not just at login time, but more frequently so if the user removes the token the application must not be accessible anymore ?
 
In Apache Http Server there is an option to configure the SSL Session Timeout, but could not find this in JBoss AS (in embedded Tomcat):

anonymous wrote : Apache Http Server
  | #  SessionCache Timeout:
  | #  This directive sets the timeout in seconds for the information stored
  | #  in the global/inter-process SSL Session Cache. It can be set as low as
  | #  15 for testing, but should be set to higher values like 300 in real life.
  | SSLSessionCacheTimeout  30

The SSL Connector in JBoss is configured as follows:

<!-- SSL/TLS Connector with encrypted  keystore/truststore  password configuration  -->
  |     <Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
  |          maxThreads="150" scheme="https" secure="true"
  | 		 clientAuth="true" strategy="ms"
  | 	     address="${jboss.bind.address}"
  |          sslProtocol = "TLS" 
  |          securityDomain="java:/jaas/security-domain"
  |          SSLImplementation="org.jboss.net.ssl.JBossImplementation" />

The JaasSecurityDomain MBean is configured like this:
<server>
  |    <mbean code="org.jboss.security.plugins.JaasSecurityDomain"
  |       name="jboss.security:service=SecurityDomain">
  |       <constructor>
  |          <arg type="java.lang.String" value="security-domain"></arg>
  |       </constructor>
  |       <attribute name="KeyStoreURL">${jboss.server.home.dir}/conf/server.keystore</attribute>
  |       <attribute name="KeyStorePass">{CLASS}org.jboss.security.plugins.FilePassword:${jboss.server.home.dir}/conf/serverKeystore.password</attribute>
  | 	  <attribute name="TrustStoreURL">${jboss.server.home.dir}/conf/user.truststore</attribute>
  |       <attribute name="TrustStorePass">{CLASS}org.jboss.security.plugins.FilePassword:${jboss.server.home.dir}/conf/userTruststore.password</attribute>
  |       <attribute name="Salt">jbossserver</attribute>
  |       <attribute name="IterationCount">13</attribute>
  |    </mbean>
  | </server>

Any help at all would be highly appreciated. 

Thanks.
Andrei


 


View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4225896#4225896

Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4225896