Where is smart card authentication done for Java Web apps?
<p>I am rather stumped by trying to identify where CAC/Active Directory(AD) authentication comes into play for Java based web applications. Take for example multiple J2E JSF applications hosted on multiple Weblogic containers. Each of those applications limits access of the user by checking what AD role they are in. At what stage does one perform CAC/AD authentication, if all of these applications require it?</p>

<p>It was my understanding that ideally, you want a gateway seperate from your applications that does the authentication. A simple example is F5 hardware/sotware bundle. Once the user authenticates with their CAC/pin combo, they are forwarded to the deployed application on Weblogic, with some additional information in their headers(like the AD roles previously mentioned). I am not saying that I should purchase that as there is no programmable solution, rather as an example that authentication and resources of use are two seperate entities, and should not necesarily be combined for this problem.</p>

<p>In practice, however, I have read that many projects are combining Microsoft and Apache services to allow authentication. <a href="https://people.apache.org/~mturk/docs/article/ftwai.html" rel="nofollow noreferrer">Here is a good blog post that outlines some benefits.</a> Once a user authenticates against IIS, they are forwarded to the application on apache. Regardless, mixing IIS and Weblogic just seems like a bad idea off the bat, especially when trying to configure the communication betweem the two nodes. </p>

<p>There are also numerous posts on stack and the web, dating back to pre 2012 days, which reccomend different solutions. <a href="https://stackoverflow.com/questions/544056/common-access-card-cac-authentication-using-java?rq=1">One post recommends the following:</a></p>

<blockquote>
  <p>you can specify set of acceptable certificate policies when the server
  validates the client certificate</p>
</blockquote>

<p>While the answer makes sense in general terms, the author never goes into architectual details for this communication to take place. Some other posts reccomend <a href="http://www.josso.org" rel="nofollow noreferrer">JOSSO</a>, to perform SSO functionality like the gateway mechanisam previously mentioned. This post also talks about using <a href="https://stackoverflow.com/questions/3574315/pkcs11-driver-for-cac-card-card-reader?rq=1">PKCS11</a> for reading smart cards directly by using the manufacturer provided drivers.  There are also questions that have no answer, such as <a href="https://stackoverflow.com/questions/15784107/authenticating-ad-server-user-using-dod-issued-cac-in-java?rq=1">Authenticating AD server user using DOD issued CAC in java</a> . </p>

<p>Considering it has been, on average, 5 years between some of these posts, I am unsure what todays best practice is for this problem. Is the gateway approach an ideal way to do authentication? Are my ideas not applicable at all and a better solution exists?</p>