x509 authentication bypassing ldap.

[Ian Bobbitt]

On 6/3/19 9:43 AM, Peter Schober wrote:
> Note that I kind of assumed you'd use the built-in X.509 authentication
> https://wiki.shibboleth.net/confluence/display/IDP30/X509AuthnConfiguration
> not Apache httpd as reverse proxy.
> That may change what's possible and how easy/secure it its wrt
> grabbing X.509 attributes from headers/request attributes.

I don't believe it's documented, but the IdP includes a servlet filter to take the client certificate (and chain
certificates) as headers from a proxy. It should go without saying that by doing this, anything that can talk straight
to your proxy backend can pretend to be any user they have the certificate for, so only do it if you're willing to take
that risk. (Though that's the same risk as using the RemoteUser auth terminated on a proxy.)

You would set it up with something like this added to your web.xml

<filter>
    <filter-name>X509ProxyFilter</filter-name>
    <filter-class>net.shibboleth.idp.authn.impl.X509ProxyFilter</filter-class>
    <!-- Proxied header name for the leaf certificate -->
    <init-param>
        <param-name>leafHeader</param-name>
        <param-value>SSL_CLIENT_CERT</param-value>
    </init-param>
    <!-- Space-separated list of proxied header names for chain certificates. -->
    <init-param>
        <param-name>chainHeaders</param-name>
        <param-value>SSL_CLIENT_CERT_CHAIN_0 SSL_CLIENT_CERT_CHAIN_1 SSL_CLIENT_CERT_CHAIN_2 SSL_CLIENT_CERT_CHAIN_3
SSL_CLIENT_CERT_CHAIN_4</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>X509ProxyFilter</filter-name>
    <url-pattern>/Authn/X509</url-pattern>
</filter-mapping>

And something like this added to your Apache config

SSLCACertificateFile /path/to/your/root-cas.pem
<Location /idp/Authn/X509>
    SSLVerifyClient require
    SSLVerifyDepth  5
    SSLOptions +ExportCertData
    RequestHeader set SSL_CLIENT_CERT            "%{SSL_CLIENT_CERT}s"
    RequestHeader set SSL_CLIENT_CERT_CHAIN_0    "%{SSL_CLIENT_CERT_CHAIN_0}s"
    RequestHeader set SSL_CLIENT_CERT_CHAIN_1    "%{SSL_CLIENT_CERT_CHAIN_1}s"
    RequestHeader set SSL_CLIENT_CERT_CHAIN_2    "%{SSL_CLIENT_CERT_CHAIN_2}s"
    RequestHeader set SSL_CLIENT_CERT_CHAIN_3    "%{SSL_CLIENT_CERT_CHAIN_3}s"
    RequestHeader set SSL_CLIENT_CERT_CHAIN_4    "%{SSL_CLIENT_CERT_CHAIN_4}s"
</Location>

You can then access any part of the certificate the same ways you could if you were terminating TLS at your servlet runtime.

-- Ian


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4090 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20190603/4007cca1/attachment.p7s>