X509 Authn behind Apache proxy

[Ian Bobbitt]

I'm looking into the feasibility of letting my users optionally 
authenticate with their smart card badge. From the recent "Triggering 
another authentication flow from authn/Password" thread, I have what I 
need to let them jump from the Password flow to X509.

I'm running the IdP in Jetty behind Apache. From 
<https://wiki.eclipse.org/Jetty/Tutorial/Apache> it looks like get the 
client certificate through an Apache proxy is to have Apache send the 
client certificate (and chain) as headers, and have the servlet use 
those headers instead of the javax.servlet.request.X509Certificate 
attribute. That appears to be what the flow described at 
<https://wiki.shibboleth.net/confluence/display/SHIB2/X.509+Login+Handler> 
did in IdP v2. That also shows me an example of using the X500 
principal, if it exists, for searching in an LDAP directory instead of 
using the "normal" principal from more traditional flows that's similar 
enough to get me started.

Is this something you would be interested in adding, or would accept 
patches for? I'm a developer, and I see in 
net.shibboleth.idp.authn.impl.ExtractX509CertificateFromRequest where I 
could check headers, but I haven't written more than a few lines of Java 
in nearly 15 years. I can probably copy enough out of 
net.shibboleth.idp.authn.impl.ExtractRemoteUser (and related spring 
files) to make checking headers (and which headers to check) 
configurable that isn't completely hacked together.

-- Ian

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3639 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170622/c7d884c4/attachment.p7s>