title: SOAP Web Service with SSL authentication in Spring Boot
body: <p>I made 2 SOAP web services in java using Metro stack. To prevent undesired requests, they can only be made as long as the requester owns a client certificate. To do so, the web.xml looked like the following piece of code:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" id="WebApp_ID" version="3.1"&gt;
    &lt;display-name&gt;PadronExterno&lt;/display-name&gt;
    &lt;welcome-file-list&gt;
      &lt;welcome-file&gt;index.html&lt;/welcome-file&gt;
      &lt;welcome-file&gt;index.htm&lt;/welcome-file&gt;
      &lt;welcome-file&gt;index.jsp&lt;/welcome-file&gt;
      &lt;welcome-file&gt;default.html&lt;/welcome-file&gt;
      &lt;welcome-file&gt;default.htm&lt;/welcome-file&gt;
      &lt;welcome-file&gt;default.jsp&lt;/welcome-file&gt;
    &lt;/welcome-file-list&gt;
    &lt;listener&gt;
      &lt;listener-class&gt;
              com.sun.xml.ws.transport.http.servlet.WSServletContextListener
          &lt;/listener-class&gt;
    &lt;/listener&gt;
    &lt;servlet&gt;
      &lt;servlet-name&gt;WebServicePort&lt;/servlet-name&gt;
      &lt;servlet-class&gt;
              com.sun.xml.ws.transport.http.servlet.WSServlet
          &lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
    &lt;servlet&gt;
      &lt;servlet-name&gt;TomcatStartupServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;com.company.TomcatStartupServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
    &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;WebServicePort&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/theWebService&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
    &lt;security-constraint&gt;
      &lt;display-name&gt;Constraint1&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;theWebService&lt;/web-resource-name&gt;
        &lt;description&gt;&lt;/description&gt;
        &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;user-data-constraint&gt;
        &lt;description&gt;&lt;/description&gt;
        &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
    &lt;/security-constraint&gt;
    &lt;login-config&gt;
      &lt;auth-method&gt;CLIENT-CERT&lt;/auth-method&gt;
    &lt;/login-config&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>Recently I've developed a brand-new soap ws, but I wanted to try Spring Boot. I started using Spring Initializr. The web service is entirely coded, finished, but it lacks the part of SSL authentication/authorization.</p>
  
  <p><em>Edit</em>:</p>
  
  <p>I've come up with a possible solution, but I've something missing. this is so far what I've been able to write:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
      @Autowired
      private Configuracion config;
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          // Add support for HSTS
          http
              .headers()
                  .httpStrictTransportSecurity()
                      .includeSubDomains(true)
                      .maxAgeInSeconds(31536000);
  
          // Disable HTTP         
          http.httpBasic().disable();
  
          Integer httpPuerto = config.getHttpPuerto();
          Integer httpsPuerto = config.getHttpsPuerto();
          http
              .portMapper()
                  .http(httpPuerto)
                  .mapsTo(httpsPuerto);
  
          http.requiresChannel().anyRequest().requiresSecure();
      }
  }
  </code></pre>
  
  <p>Unfortunately, when running into my app server (Tomcat 8.5 with SSL/TLS enabled), you can run it without owning the client certificate. As requested, here you're my Tomcat's connector config:</p>
  
  <pre><code>&lt;Connector 
      connectionTimeout="20000" 
      port="9090" 
      protocol="HTTP/1.1" 
      redirectPort="9443"/&gt;
  &lt;Connector 
      SSLEnabled="true" 
      keystorePass="***d" 
      keystoreType="JKS" 
      maxThreads="200" 
      port="9443" 
      protocol="org.apache.coyote.http11.Http11Nio2Protocol" 
      scheme="https" 
      secure="true" 
      sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation" 
      sslProtocol="TLSv1.2"
      clientAuth="want" 
      keystoreFile="D:\apache\Tomcat8.5\certs\tomcat.jks" 
  &lt;Connector port="9009" protocol="AJP/1.3" redirectPort="9443"/&gt;
      ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA" /&gt;
  </code></pre>
  
  <p>Am I missing something within my <code>WebSecurityConfigurerAdapter</code>? Thank you</p>