summaryrefslogtreecommitdiffstats
path: root/src/main
diff options
context:
space:
mode:
authorOdd Eirik Nes <oddeirik@gmail.com>2016-10-17 16:58:23 +0200
committerOdd Eirik Nes <oddeirik@gmail.com>2016-10-17 16:58:23 +0200
commit7a0639b514cff77fe5b149b16a6eb8f1f216443b (patch)
treea8774ac1fb6a35659a3fbc8048a9fc3dd325befe /src/main
parenta3665a6a8218cb19eef6bbddcbbc317258f616f1 (diff)
downloadgitblit-7a0639b514cff77fe5b149b16a6eb8f1f216443b.tar.gz
gitblit-7a0639b514cff77fe5b149b16a6eb8f1f216443b.zip
Add setting to explicitly enable or disable optional client certificates.
Diffstat (limited to 'src/main')
-rw-r--r--src/main/distrib/data/defaults.properties13
-rw-r--r--src/main/java/com/gitblit/GitBlitServer.java5
2 files changed, 15 insertions, 3 deletions
diff --git a/src/main/distrib/data/defaults.properties b/src/main/distrib/data/defaults.properties
index 0c7d6cd4..852ea447 100644
--- a/src/main/distrib/data/defaults.properties
+++ b/src/main/distrib/data/defaults.properties
@@ -2059,8 +2059,8 @@ server.storePassword = gitblit
# authenticate with ssl certificates. If enabled, only https clients with the
# a valid client certificate will be able to access Gitblit.
#
-# If disabled, client certificate authentication is optional and will be tried
-# first before falling-back to form authentication or basic authentication.
+# If disabled, optional client certificate authentication is configurable by
+# server.wantClientCertificates
#
# Requiring client certificates to access any of Gitblit may be too extreme,
# consider this carefully.
@@ -2069,6 +2069,15 @@ server.storePassword = gitblit
# RESTART REQUIRED
server.requireClientCertificates = false
+# If enabled, client certificate authentication is optional and will be tried
+# first before falling-back to form authentication or basic authentication.
+#
+# If disabled, no client certificate authentication will be done at all.
+#
+# SINCE 1.8.1
+# RESTART REQUIRED
+server.wantClientCertificates = false
+
# Port for shutdown monitor to listen on.
#
# SINCE 0.5.0
diff --git a/src/main/java/com/gitblit/GitBlitServer.java b/src/main/java/com/gitblit/GitBlitServer.java
index d56d9c0c..7b6cbbad 100644
--- a/src/main/java/com/gitblit/GitBlitServer.java
+++ b/src/main/java/com/gitblit/GitBlitServer.java
@@ -288,7 +288,7 @@ public class GitBlitServer {
if (params.requireClientCertificates) {
factory.setNeedClientAuth(true);
} else {
- factory.setWantClientAuth(true);
+ factory.setWantClientAuth((params.wantClientCertificates));
}
ServerConnector connector = new ServerConnector(server, factory);
@@ -597,6 +597,9 @@ public class GitBlitServer {
@Option(name = "--requireClientCertificates", usage = "Require client X509 certificates for https connections.")
public Boolean requireClientCertificates = FILESETTINGS.getBoolean(Keys.server.requireClientCertificates, false);
+ @Option(name = "--wantClientCertificates", usage = "Ask for optional client X509 certificate for https connections. Ignored if client certificates are required.")
+ public Boolean wantClientCertificates = FILESETTINGS.getBoolean(Keys.server.wantClientCertificates, false);
+
/*
* Setting overrides
*/