Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of tom.browder@gmail.com
 designates 209.85.216.45 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <5068E767.6030408@catseye.org>
References: 
 <CAFMGiz995EecFDHnXAWAvw3pM8fMWq-gcLaZF2D_-fURoHmVow@mail.gmail.com>
 <5068E767.6030408@catseye.org>
From: Tom Browder <tom.browder@gmail.com>
Date: Mon, 1 Oct 2012 04:41:21 -0500
Message-ID: 
 <CAFMGiz8zrFuaY0hVsTC7zOUDP1d87JE+cK3-dCPXV-9+Fj_c=g@mail.gmail.com>
To: Mark Montague <mark@catseye.org>
Cc: users@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [users@httpd] SSL Client Certificates and CGI

On Sun, Sep 30, 2012 at 7:44 PM, Mark Montague <mark@catseye.org> wrote:
> On September 30, 2012 19:45 , Tom Browder <tom.browder@gmail.com> wrote:
>>
>> Does anyone have a pointer to help on restricting a directory to
>> access only with valid SSL Client Certificates and how to work CGI
>> scripts to respect that restriction?
...
> So you are allowing requests for the CGI from any web browser, without a
> client certificate, but you then want to restrict what the CGI can do when
> it is running?
>
> A CGI won't "respect" web server configuration for what clients can access
> what content, because CGIs can't "see" web server configuration.  The web
> server invokes the CGI, and the CGI can do whatever it wants to do from that
> point on.  The only restrictions on a running CGI are those imposed by the
> operating system.

So, Mark, what about something like this:

+ if the cgi prog:

   - finds the appropriate SSL cert envvar to be defined
   - finds that envvar to satisfy apprporiate criteria

+ then

  - run to normal completion

+ otherwise

  - return not authorized

Best,

-Tom

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org