Return-Path: X-Original-To: apmail-directory-dev-archive@www.apache.org Delivered-To: apmail-directory-dev-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id F29C0173DF for ; Fri, 13 Mar 2015 12:30:33 +0000 (UTC) Received: (qmail 57168 invoked by uid 500); 13 Mar 2015 12:30:11 -0000 Delivered-To: apmail-directory-dev-archive@directory.apache.org Received: (qmail 57111 invoked by uid 500); 13 Mar 2015 12:30:11 -0000 Mailing-List: contact dev-help@directory.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: "Apache Directory Developers List" Delivered-To: mailing list dev@directory.apache.org Received: (qmail 57101 invoked by uid 99); 13 Mar 2015 12:30:11 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 13 Mar 2015 12:30:11 +0000 X-ASF-Spam-Status: No, hits=1.5 required=5.0 tests=HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of mboorshtein@gmail.com designates 209.85.218.47 as permitted sender) Received: from [209.85.218.47] (HELO mail-oi0-f47.google.com) (209.85.218.47) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 13 Mar 2015 12:30:05 +0000 Received: by oiba3 with SMTP id a3so9506517oib.1 for ; Fri, 13 Mar 2015 05:28:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=f5czh4+aWXIy1+nU7QgT/3JVit0NYwomIzhMXnJt9p0=; b=u3UdS1xMYQZWQM637XA4myGP2HNUstQzGW3iJr+8qIVOrUZQ6voXbngPO/wc6uE3mw LikTcLq31KWSMqfJOPnm+i6w6fXaC8SUojfmpqzmDwsRniTModH0bvvgYJbZzjgBeDNO kgZqSGj7Hh0Vt/UZgGLk5JHGdENBKdtuDrnHhVAagcP8a3cqGnuyrbbewAo6gchUckgx qwH1zBV+p06i79mmBOaKEbEkGv7aAsW1zuEPGbuux8YwyQe5FgVMMPa8XjeGoQpHWkzL f585evPNq5rK+wLx1IXMH+EBDqgohsotOPMXrA2+xmnA7F4Fd22hugoKv3U7F5wqJrF3 g8pw== MIME-Version: 1.0 X-Received: by 10.202.225.130 with SMTP id y124mr35476818oig.58.1426249695343; Fri, 13 Mar 2015 05:28:15 -0700 (PDT) Received: by 10.202.65.193 with HTTP; Fri, 13 Mar 2015 05:28:15 -0700 (PDT) In-Reply-To: References: Date: Fri, 13 Mar 2015 08:28:15 -0400 Message-ID: Subject: Re: Where can I get the client certificate? From: Marc Boorshtein To: Apache Directory Developers List Content-Type: multipart/alternative; boundary=001a113d610473bd3405112aa2e5 X-Virus-Checked: Checked by ClamAV on apache.org --001a113d610473bd3405112aa2e5 Content-Type: text/plain; charset=UTF-8 >> Well thats untrue. The certificate can be used for user mapping, >> authorization, etc. This is VERY common in the HTTP world. In a servlet >> you can get the certificate, DN, etc from the request object. >> >> not the case in LDAP, AFAIK > OK well if it wasn't the case I wouldn't have folks asking for it :-) > That being said, I have extended the server ( >> http://sourceforge.net/p/myvd/code/HEAD/tree/trunk/MyVD/src/main/java/org/apache/directory/server/ldap/LdapServer.java) >> mainly so I can do custom SSL implementations so I can easily create a >> custom trust manager. The question becomes how can I associate the cert I >> get from the trust manager to an LDAP session? Neither the trust manager >> nor the keystore actually has that context. >> >> likewise you need to extend the LdapSession class as well and inject the > cert after authentication, > but to get the actual certificate to inject you need support from MINA. > > Modifying the SslFilter should be the right place to pin certificate as a > property in IoSession instance > Thats a great starting point. Thanks --001a113d610473bd3405112aa2e5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable



Well thats untrue.=C2= =A0 The certificate can be used for user mapping, authorization, etc.=C2=A0= This is VERY common in the HTTP world.=C2=A0 In a servlet you can get the = certificate, DN, etc from the request object. =C2=A0

not the case in LDAP, AFAIK

OK well if it wasn&#= 39;t the case I wouldn't have folks asking for it :-) =C2=A0
= =C2=A0
That being said, I ha= ve extended the server (http://sourceforge.net/p/myvd/code/HEAD/tree/trunk/M= yVD/src/main/java/org/apache/directory/server/ldap/LdapServer.java) mai= nly so I can do custom SSL implementations so I can easily create a custom = trust manager.=C2=A0 The question becomes how can I associate the cert I ge= t from the trust manager to an LDAP session?=C2=A0 Neither the trust manage= r nor the keystore actually has that context.

likewise you need to extend the LdapSessi= on class as well and inject the cert after authentication,
bu= t to get the actual certificate to inject you need support from MINA.
Modifying the SslFilter should be the right place to pin certi= ficate as a property in IoSession instance

Thats a great starting point.=C2=A0 Thanks
=C2=A0
--001a113d610473bd3405112aa2e5--