(401)Cannot authenticate with the provided credentials

hi!

I have a interesting problem:

I would like to propagate the UserPrincipal to Tomcat with client-auth an Apache side enabled.

My architecture is:

- Apache in SSL with Client Authentication
- mod_jk activate on port 8009
- Tomcat listening on port 8009 with Security Realm configured with CLIENT-CERT.
- tomcat-users.xml with the subjectDN of the user cert:

the question are:

1) which pwd I have to specify?
2) Have I to configure the keystores also in tomcat?
2) why I receive: "(401)Cannot authenticate with the provided credentials"

Thanks