title: configure tomcat for client authentication only for specific URL patterns
body: <p>I have an application with a few war files all deployed on the same tomcat server. I need to force client authentication only for one war context, and only for a specific URL.</p>
  
  <p>I've read a lot on the web and similar questions here, but the conclusions I've reached are not matching the solution I need:</p>
  
  <ol>
  <li>define 2 connectors with different ports (one with clientAuth enabled and one without) and access the specific URL with the relevant port ==> this solution is not good since if a hacker tries to access this URL with the other port he can succeed</li>
  <li>define transport-guarantee in web.xml (for example <a href="https://stackoverflow.com/questions/13246961/enabling-mutual-ssl-per-service-in-tomcat">Enabling mutual SSL per service in Tomcat</a>) ==> this is also not good since I don't want to define users in some realm, I just want the server to ask for the client certificate and verify it is trusted and valid.</li>
  </ol>
  
  <p>Is there a way to use option 2 without defining users? Or maybe a third option?</p>
  
  <p>Thanks in advance!</p>