Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of tevans.uk@googlemail.com
 designates 209.85.216.45 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=googlemail.com; s=gamma;
        h=mime-version:date:message-id:subject:from:to:content-type;
        b=RcWXu/RpJGt3gtbWwE035ScwAybOEblFJ5LtYHq7f9/KAgxltiyQylmYH3P3ogZ6og
         k+FpPlHZTMvCPauXhs/cAPR7D9Y77fka2Xv3KBju4KlVF5LtwX/x/wpRm5PzilLDOv3m
         Iyj5dtxEq9HdDDYnXPh6Hu5vH1seKE98Fk4Rk=
MIME-Version: 1.0
Date: Fri, 21 Jan 2011 10:24:54 +0000
Message-ID: <AANLkTikPLhMKz1r5g+uJf6f1YcQ-fz0D5zp=EDd83vEh@mail.gmail.com>
From: Tom Evans <tevans.uk@googlemail.com>
To: users@httpd.apache.org
Content-Type: text/plain; charset=UTF-8
Subject: [users@httpd] mod_ssl, client certificates and r->username

Hi all

Apache/2.2.17 (FreeBSD)

I'm trying to use client certificates to authenticate my few users. I
created a self-signed CA, server certificates and user certificates,
and installed them in the appropriate places. I then created a vhost:

<VirtualHost *:443>
    ServerName rc.ketbun.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/ketbun/star.ketbun.com/apache.crt
    SSLCertificateKeyFile /etc/ssl/ketbun/star.ketbun.com/apache.key
    SSLCACertificateFile /etc/ssl/ketbun/ca.crt
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLCARevocationFile /etc/ssl/ketbun/ca.crl
    SSLOptions +FakeBasicAuth +StdEnvVars
    RequestHeader set X-Username %{SSL_CLIENT_S_DN_Email}s
</VirtualHost>

This all works nicely, and users can only access if they have been
issued with keys/certificates and installed them in their browser.
However, I can't seem to get any of these details to be logged.

Without creating phony .htpasswd files listing all my users with dummy
passwords, is there any way to extract an attribute from the client
certificate's DN and use that to populate r->username? FakeBasicAuth
doesn't seem to want to do anything without the dummy .htpasswd, and
whilst I can pass the information easily enough to the webapps without
this (adding it as a request header), this doesn't help me get the
info into the access logs.

Any ideas?


Cheers

Tom

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org