2

My general question: Can a two-way SSL connection be forwarded to a 3rd server?

The specifics: I have a WebLogic server supporting two way-SSL, client side's cert is from their CAC card. The weblogic server acts as a gateway to an Oracle Database. Oracle can authenticate the user via Username/password or, preferably, by SSL. Is there a way the weblogic server with an established SSL connection can re-use the client's cert to connect to the db? Assume control over all machines (Database server, Weblogic Server, and Client PC via Java applet).

1
  • 1
    The general question looks appropriate to security, the specific question may be more appropriate to web applications/programmers/stackoverflow.
    – DKATyler
    Jul 31, 2015 at 13:54

2 Answers 2

3

Is there a way the weblogic server with an established SSL connection can re-use the client's cert to connect to the db?

No, there is no SSL equivalent to SSH Agent Forwarding; the SSL server cannot forward the client certificate credentials to another server.

Now, that's not to say you can't leverage the credentials. If your weblogic server validates the client certificate, and then inserts an "X-I-Authenticated-The-Client: username" header, the backend DB can then treat that as an authentication if, as you say, you have control over and trust between the weblogic and the database layer.

(That's harder if you're not using something like HTTP, but even database connections can do it; consider PostgreSQL 'Trust' or 'Ident' authentication methods.)

-1

SSL certificates can't be used by a third party. Connections rely on each party using a certificate with their own name on it.

Consider implementing a Single-Sign On solution which will allow the user to authenticate once and seamlessly connect to each server.

4
  • The cert in question is the client cert.
    – schroeder
    Jul 31, 2015 at 14:40
  • Yes, but the webLogic server can't use it to connect on behalf of the client.
    – ztk
    Jul 31, 2015 at 14:50
  • 1
    I'm finding your Answer confusing, I think because you leave out some details. Can you flesh out your Answer a little more?
    – schroeder
    Jul 31, 2015 at 14:56
  • Not necessarily true that each party uses a cert with their own name on it. Given control over all machines, the db and the weblogic server can use the same SSL cert for their side.
    – DKATyler
    Jul 31, 2015 at 15:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .