java - JBOSS 7 with two contexts. One with SSL Mutual Auth and the other just SSL -

we having problem configure our jboss. tring configure make possible use @ same time mutual auth , don't use it. like:

https://example.com/contexta/ (requires ssl mutual auth) https://example.com/contextb/ (just ssl)

is possible?

what make or jboss use ssl mutual auth or don't. how can configure both @ same time?

my contexta web.xml:

<!doctype web-app public  "-//sun microsystems, inc.//dtd web application 2.3//en"  "http://java.sun.com/dtd/web-app_2_3.dtd" >  <web-app>     <display-name>contexta</display-name>      <security-constraint>         <web-resource-collection>             <web-resource-name>services</web-resource-name>             <url-pattern>/*</url-pattern>             <http-method>get</http-method>         </web-resource-collection>         <auth-constraint>             <role-name>*</role-name>         </auth-constraint>         <user-data-constraint>             <transport-guarantee>confidential</transport-guarantee>         </user-data-constraint>     </security-constraint>      <login-config>         <auth-method>client-cert</auth-method>     </login-config>      <security-role>         <role-name />     </security-role> </web-app> 

my contexta jboss-web.xml

<?xml version="1.0" encoding="utf-8"?> <jboss-web>     <security-domain>requirecertificatedomain</security-domain> </jboss-web> 

contextb web.xml

<?xml version="1.0" encoding="utf-8"?> <web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/xmlschema-instance" xsi:schemalocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">      <display-name>contextb</display-name>      <jsp-config>         <jsp-property-group>             <url-pattern>*.jsp</url-pattern>             <trim-directive-whitespaces>true</trim-directive-whitespaces>         </jsp-property-group>     </jsp-config>      <session-config>         <session-timeout>10</session-timeout>         <cookie-config>             <http-only>true</http-only>         </cookie-config>     </session-config>      <welcome-file-list>         <welcome-file>index.jsp</welcome-file>     </welcome-file-list>      <security-constraint>         <display-name>secureapplicationconstraint</display-name>         <web-resource-collection>             <web-resource-name>contextb</web-resource-name>             <description>auth applications secured</description>             <url-pattern>/login/*</url-pattern>         </web-resource-collection>         <auth-constraint>             <description>only users roles allowed</description>             <role-name>user</role-name>         </auth-constraint>         <user-data-constraint>             <transport-guarantee>confidential</transport-guarantee>         </user-data-constraint>     </security-constraint>      <security-constraint>         <display-name>securechannelconstraint</display-name>         <web-resource-collection>             <web-resource-name>entire site protected through ssl</web-resource-name>             <description />             <url-pattern>/contextb/*</url-pattern>         </web-resource-collection>         <user-data-constraint>             <description>require encrypted channel</description>             <transport-guarantee>confidential</transport-guarantee>         </user-data-constraint>     </security-constraint>      <login-config>         <auth-method>form</auth-method>         <realm-name>contextbpolicy</realm-name>         <form-login-config>             <form-login-page>/login.jsp</form-login-page>             <form-error-page>/loginerror.jsp</form-error-page>         </form-login-config>     </login-config>      <security-role>         <description/>         <role-name>user</role-name>     </security-role>  </web-app> 

contextb jboss-web.xml

<?xml version="1.0" encoding="utf-8"?> <jboss-web>     <security-domain>java:/jaas/contextbpolicy</security-domain> </jboss-web> 

content of standalone.xml

<security-domain name="contextbpolicy">     <authentication>         <login-module code="org.contextbloginmodule" flag="required"/>     </authentication> </security-domain>  (...)  <security-domain name="requirecertificatedomain">     <authentication>         <login-module code="certificateroles" flag="required">             <module-option name="securitydomain" value="requirecertificatedomain"/>             <module-option name="verifier" value="org.jboss.security.auth.certs.anycertverifier"/>             <module-option name="usersproperties" value="file:c:/tmp/my-users.properties"/>             <module-option name="rolesproperties" value="file:c:/tmp/my-roles.properties"/>         </login-module>     </authentication>     <jsse keystore-password="changethis" keystore-url="file:c:/tmp/localhost.jks" truststore-password="changethis" truststore-url="file:c:/tmp/cacerts.jks"/> </security-domain>  (...)  <subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">     <configuration>         <jsp-configuration x-powered-by="false"/>     </configuration>     <connector name="http" protocol="http/1.1" scheme="http" socket-binding="http"/>     <connector name="https" protocol="http/1.1" scheme="https" socket-binding="https" secure="true">         <ssl name="ssl" key-alias="localhost" password="changethis" certificate-key-file="../standalone/configuration/localhost.jks" verify-client="require" ca-certificate-file="../standalone/configuration/cacerts.jks" truststore-type="jks"/>     </connector>     <virtual-server name="default-host" enable-welcome-root="true">         <alias name="localhost"/>         <alias name="example.com"/>     </virtual-server> </subsystem> 

in opinion, it's impossible based on http endpoint.

reason being ssl/tls-handshake happens before client sends http request server.

the endpoint (eg /contexta) resides in http request!

at start of ssl/tls-handshake, hostname (eg example.com) available (and if client has sni enabled).

so you'll need 2 different hostnames this. example contexta.example.com , contextb.example.com