There shouldn’t be any problems and I’m not aware of any special things you need to do to use https in your applications.
SSL is configured at the web server level, so the server documentation is the best place to start.
I’ve also seen applications using SSL client certificate authentication: User log in simply using their installed certificate (without any username/password form). This approach needs some kind of communication between the server (protocol) and the IT Mill Toolkit application to make the user information available to the rest of the application.
Good to hear there is nothing special that needs to be done.
Do you know if any code in the incubator, samples, etc uses the SSL client certificate authentication method ? - I noticed the tkIRC application in the incubator was using SSL, but haven’t looked into it in any detail - do you know if that application uses the SSL client certificate authentication method ?
Joonas, just saw that your authentication code is placed into the transactionEnd method. Im always using transactionStart to access servlet and http objects to prepare some extra info for the application, am I wrong and should use transactionEnd instead ?
When both callback methods are invoked during the single request life-cycle ?
Start is invoked in the beginning of the transaction and end in the end. Placing auth to end seems strange to me too (just cut n pasted the code from one old app). It should work fine in the transactionStart too.
Is transaction end equals http request end ? If yes, making an auth there seems to be strange because this request is already processed and auth data (principal set) will be available on next request only. Or Im missing something ?