Mailing-List: contact modules-dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: modules-dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of ohaya@cox.net designates
 68.230.241.215 as permitted sender)
Message-ID: <20120617222243.IMCHI.126198.root@eastrmwml105>
Date: Sun, 17 Jun 2012 22:22:43 -0400
From: <ohaya@cox.net>
To: modules-dev@httpd.apache.org
Subject: Re: How to access client certificate PEM and incoming request
 headers in a module?
Cc: Ben Noordhuis <info@bnoordhuis.nl>
In-Reply-To: 
 <CAHQurc-3A2jri2CFe=uJx5nptj++sqR9AxZXFxzsKtKdxC7NMg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Sensitivity: Normal


---- Ben Noordhuis <info@bnoordhuis.nl> wrote:=20
> On Sun, Jun 17, 2012 at 9:46 PM,  <ohaya@cox.net> wrote:
> > Hi,
> >
> > I am starting to look into implementing an Apache module that can use i=
nformation from an incoming request, including several headers and the subj=
ect string from a client certificate to do authentication.
> >
> > I've been looking at the source for mod_auth_certificate, from https://=
modules.apache.org/, as a starting point.
> >
> > However, it looks like the way that mod_auth_certificate works is that =
it requires that there's an SSLUserName directive to put the client certifi=
cate DN into the Apache REMOTE_USER attribute, whereas I need the entire PE=
M for the client cert to do authentication that I'm trying to do.
> >
> > So I was wondering if it's possible for a module to access the SSL_CLIE=
NT_S_DN and SSL_CLIENT_CERT environment variables, and if so, how?
>=20
> They should be set in r->subprocess_env provided `SSLOptions
> +StdEnvVars +ExportCertData` is set in the server or per-directory
> config.
>=20
> > Also, as mentioned my module would need to access several HTTP headers =
that are in the incoming requests. =C2=A0How can it do that?
>=20
> Look them up with `apr_table_get(r->headers_in, "X-Header-Name")`.


Ben,

Thanks.  I'll give those a try.  We already the SSLOptions set as you menti=
oned, so assuming that I can figure out the coding (it's been a long time s=
ince I've done C/C++), that should work :)...

Jim