Spring Security - Third Edition

Configuring client certificate authentication in Spring Security

Unlike the authentication mechanisms that we have utilized thus far, the use of client certificate authentication results in the user's request being preauthenticated by the server. As the server (Tomcat) has already established that the user has provided a valid and trustworthy certificate, Spring Security can simply trust this assertion of validity.

An important component of the secure login process is still missing, that is, the authorization of the authenticated user. This is where our configuration of Spring Security comes in—we must add a component to Spring Security that will recognize the certificate authentication information from the user's HTTP session (populated ...