ECP working

[Cantor, Scott]

On 6/5/14, 1:50 AM, "Martin Haase" <Martin.Haase at DAASI.de> wrote:
>
>this is great news. Another thing quite a few clients of ours did ask
>for in the past: X.509 Authentication at the IdP with ECP. Any chance to
>decouple this from Apache as well?

Doing holder of key is not in scope right now (and I doubt any clients
could do it anyway), so that means you're tied to the container to do TLS,
there's no way to do that without extra configuration unless you use a
backchannel connector. That's where ECP starts to be a little like a back
channel profile. It has other advantages, like avoiding commercial TLS for
authenticating the IdP.

Anyway, assuming you can do it, the problem is turning the cert into a
user identity. I can knock out the Extraction action for X.509, that's
just reading the request attribute in Java and populating it into our
context tree. Actually turning that into a username is more complex, but
it's still not a large amount of work. I doubt I'll get to it for the
alpha, but I don't think it will be hard to at least have some kind of
example for the release.

-- Scott