Authenticaton with login and password or with certificate - spring

Question

I have an application with spring boot where the user can authenticate with login and password or by digital certificate.
I try to validate with user and password an it works but when i tried to validate with certificate, chrome dont show me the windows to select the certificate that i want to use in validation (i have several certificates and the server is secure, etc...)
Any ideas?
I attach the code of my WebSecurityConfigurerAdapter in case I have put something wrong
> #EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
#EnableWebSecurity
#Configuration
#RequiredArgsConstructor
#Slf4j
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
#Configuration
#Order(2)
public static class AdminSecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired
CustomAuthenticationProvider customAuthProvider;
#Override
public void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.mvcMatchers(PublicUrls.URLS).permitAll()
.anyRequest().fullyAuthenticated()
.and()
.formLogin()
.loginPage("/login")
.defaultSuccessUrl("/")
.permitAll()
.and()
.cors()
.and()
.logout()
.invalidateHttpSession(true)
.clearAuthentication(true)
.logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
.logoutSuccessUrl("/login?logout")
.permitAll();
}
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(customAuthProvider);
}
}
#Configuration
#Order(1)
public static class UserSecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired
CustomAuthenticationProvider2 customAuthProvider2;
#Override
protected void configure(HttpSecurity http) throws Exception {
http.antMatcher("/loginCert*").authorizeRequests()
.mvcMatchers(PublicUrls.URLS).permitAll()
.anyRequest().fullyAuthenticated()
.and().x509()
.subjectPrincipalRegex("CN=(.*?)(?:,|$)")
.userDetailsService(userDetailsService());
}
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(customAuthProvider2);
}
}
#Bean("authenticationManager")
#Override
protected AuthenticationManager authenticationManager() throws Exception {
return super.authenticationManager();
}
And the config properties are:
server.ssl.key-store=store/keystore.jks
server.ssl.key-store-password=changeit server.ssl.key-alias=localhost
server.ssl.key-password=changeit server.ssl.enabled=true
server.ssl.client-auth=need server.port=8443

Answer 1

To make the browser prompt you for client certificate
You need to set the below Spring property in your application.properties if using embedded tomcat
server.ssl.client-auth=need
For dedicated tomcat you need to set the below property in your server.xml
clientAuth="want"
Refer the below tutorial for setting up mutual-auth / 2-way SSL
https://www.baeldung.com/x-509-authentication-in-spring-security