title: Configuring Spring Security for X509 client authentication, it isn't prompting browser for certificate
body: <p>I'm trying to enable an application to use Client-Auth security with spring.  Here's my configuration:</p>
  
  <pre><code>  &lt;security:http pattern="/api/**" &gt;
  &lt;security:x509 subject-principal-regex="CN=(.*?)," 
    user-service-ref="x509UserService" /&gt;
    &lt;security:intercept-url pattern="/api/**" access="IS_AUTHENTICATED_FULLY" requires-channel="https" /&gt;
  &lt;/security:http&gt;
  </code></pre>
  
  <p>If I don't configure anything within web.xml or tomcat's server.xml, the browser is never prompted to send along a certificate with the request.  Consequently, it always return null in in org.springframework.security.web.authentication.preauth.x509.X509AuthenticationFilter.extractClientCertificate(HttpServletRequest) method.</p>
  
  <p>Is there something special that needs to be configured to have Spring participate in the SSL flow and request the client certificate?</p>
  
  <p>Any help would be appreciated.</p>
  
  <p>If I specify clientAuth='want' in the server.xml connector configuration, this has the undesirable side-effect of prompting everyone for certificates regardless of if they're accessing the /api path.</p>
  
  <p>Similarly, if I specify the login-config and auth-method to be CLIENT-CERT, it also challenges the user, but then I would basically have to duplicate all of the cert checking I'd be doing in spring (or so it would seem).</p>