X509 Certificates

["Tom Boyce" <tom.boyce@wellfound.com>]

Hello all,

I am working on a project that the client requires login Validation using
X509 Certificates.  Not having any experience in this area, I'm wondering if
someone can provide some guidance.  I've been reading up on container vs.
programmatic security, but I'm confused if certificates can be used in purly
container managed security or if a combination of the two is required.

The client does not want to use cookies and the plan is for form based
authentication.  Only login has to be secure.  There are two levels of login
- user and admin.  User login will be restricted to information in which
that user was involved in.  Admin will, of course, have full view.  Oracle
and Tibco are in use (if that matters).

Thanks in advance for you assistance.

Tom Boyce