X509 Authn behind Apache proxy

[Ian Bobbitt]

On 6/22/17 8:22 PM, Cantor, Scott wrote:
> On 6/22/17, 8:13 PM, "users on behalf of Ian Bobbitt" <users-bounces at shibboleth.net on behalf of ibobbitt at globalnoc.iu.edu> wrote:
>
>> Is this something you would be interested in adding, or would accept
>> patches for?
> That's fine, but it's a little more subtle than that, the standard attribute is populated as an array of Java certificate objects, while a header is text and you'd have to assume or configure encodings, etc.
Right, there are Apache variables (that I would send along as headers) 
SSL_CLIENT_CERT for the client certificate and multiple 
SSL_CLIENT_CERT_CHAIN_n for the intermediate certificates. They're PEM 
encoded. There are provisions in Apache to set these headers securely on 
proxy, not letting them come from the external request. I also see some 
helpers in org.opensaml.security.x509.X509Support (that you're using in 
the tests for ExtractX509CertificateFromRequest) to convert those PEM 
strings into X509Certificate objects.
> You could write a Java servlet filter to wrap all this and populate the standard attribute (which is what you'd have to do if you want to do this now) and I'm not sure in the scheme of things if that wouldn't be the best choice anyway, just to maintain some separation.
That sounds like it would end up cleaner. Thanks for the pointer.

-- Ian

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3639 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170622/ef0fdf0e/attachment.p7s>