From 267542b3153163e09f34c11d7a5a138d7a9bedad Mon Sep 17 00:00:00 2001
From: Joakim Erdfelt <joakim.erdfelt@gmail.com>
Date: Thu, 20 Mar 2014 14:41:53 -0700
Subject: [PATCH] 430823 - jetty-start / make NeedClientAuth (ssl) configurable
 via property

+ Added 'jetty.ssl.needClientAuth' for required client certificate auth
+ Added 'jetty.ssl.wantClientAuth' for desried client certificate auth
---
 jetty-server/src/main/config/etc/jetty-ssl.xml | 2 ++
 jetty-server/src/main/config/modules/ssl.mod   | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/jetty-server/src/main/config/etc/jetty-ssl.xml b/jetty-server/src/main/config/etc/jetty-ssl.xml
index 8eef03d9997..4ac2d3e240b 100644
--- a/jetty-server/src/main/config/etc/jetty-ssl.xml
+++ b/jetty-server/src/main/config/etc/jetty-ssl.xml
@@ -13,6 +13,8 @@
   <Set name="TrustStorePath"><Property name="jetty.base" default="." />/<Property name="jetty.truststore" default="etc/keystore"/></Set>
   <Set name="TrustStorePassword"><Property name="jetty.truststore.password" default="OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4"/></Set>
   <Set name="EndpointIdentificationAlgorithm"></Set>
+  <Set name="NeedClientAuth"><Property name="jetty.ssl.needClientAuth" default="false"/></Set>
+  <Set name="WantClientAuth"><Property name="jetty.ssl.wantClientAuth" default="false"/></Set>
   <Set name="ExcludeCipherSuites">
     <Array type="String">
       <Item>SSL_RSA_WITH_DES_CBC_SHA</Item>
diff --git a/jetty-server/src/main/config/modules/ssl.mod b/jetty-server/src/main/config/modules/ssl.mod
index 915f472d89f..c8270951a68 100644
--- a/jetty-server/src/main/config/modules/ssl.mod
+++ b/jetty-server/src/main/config/modules/ssl.mod
@@ -27,3 +27,9 @@ jetty.keystore.password=OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4
 jetty.keymanager.password=OBF:1u2u1wml1z7s1z7a1wnl1u2g
 jetty.truststore.password=OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4
 
+# Set the client auth behavior
+# Set to true if client certificate authentication is required
+# jetty.ssl.needClientAuth=true
+# Set to true if client certificate authentication is desired
+# jetty.ssl.wantClientAuth=true
+