RemoteUser and X509 client certificate

[Oluf Færø]

Hi,

I need to implement X509 client certificate authentication using an apache 2.4 as a reverse proxy and Shibboleth as the SAML IDP.

Currently Apache validates the certificate and successfully proxies the request to the Shibboleth IDP running in Jetty.

But I am in doubt if I should configure Shibboleth to use the RemoteUser authenticator or if I should go for one of the other authenticators.

The RemoteUser works and picks up the user name which is included in the header SSL_CLIENT_S_DN_UID from the apache proxy. But it does not make any check to validate if the username is valid.

The user client certificate is valid, but to resolve the attributes successfully it is also necessary that the user name is exists, right? I would prefer at configuration where the attribute resolution queries a database for the attributes based on the user name.

Can you please provide any guides on how this should be implemented


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180123/1a7a4deb/attachment-0001.html>