title: Implementing PKI authentication in Spring Security
body: <p>I'm trying to figure out where and how I can implement PKI authentication in an existing Spring Security implementation.</p>
  
  <p>I changed my configuration of my server.xml in tomcat to have two Connectors to handle "normal" username and password authentication and then the "PKI" authentication.  The difference is the PKI connector has clientAuth enabled and points to the issued truststore on the machine.</p>
  
  <p>This allows the user to choose which way they would like to authenticate, they can click normal username/password authentication to go to one connector, or they can click PKI authentication to use the other.  My configuration of tomcat correctly prompts the user to use their cert and enter their pin at which I receive a HttpServletRequest with the X509Certificate cert chain.</p>
  
  <p>So now that I have this set up, how do I configure Spring Security to allow either form of authentication?  I am trying to figure out how to use the EDI of the cert as a replacement of the username/password, and still do security checks like checking the expiration date, seeing if the card is revoked, etc.</p>
  
  <p>Any ideas or links are greatly appreciated, Thanks!</p>