title: Using CLIENT-CERT for Tomcat without specifying a username
body: <p>I am trying to make a Tomcat web application use client certificate authentication for incoming connections.  Everything works fine when using clientAuth=true in server.xml, however due to other applications running on the same server, we cannot use this in the production environment.</p>
  
  <p>Is there a way to form a web.xml document such that it forces client certificate usage for the application in the same way as clientAuth=true?  It seems like using the CLIENT-CERT setting also requires you to setup a tomcat user account for each certificate which is to access your system?  We need to be able to allow all certificates which are from a specified CA (set in the server truststore) where the subject matches certain rules (checked within the actual application).  I was hoping that something like the following would work, but no luck yet!</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Everything&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;user-data-constraint&gt;
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;login-config&gt;
      &lt;auth-method&gt;CLIENT-CERT&lt;/auth-method&gt;
  &lt;/login-config&gt;
  </code></pre>