Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of knacktus@googlemail.com
 designates 209.85.213.180 as permitted sender)
MIME-Version: 1.0
Date: Sun, 26 Oct 2014 10:37:33 +0100
Message-ID: 
 <CAHsw7z+Cxi-ANZGGp-F26ykYB1jz533XzR09_59TpW-1x2jMjw@mail.gmail.com>
From: Knacktus <knacktus@googlemail.com>
To: users@httpd.apache.org
Content-Type: multipart/alternative; boundary=089e01183b60e32b3a0506502968
Subject: [users@httpd] Map ClientCertificate to AD User with different DN

--089e01183b60e32b3a0506502968
Content-Type: text/plain; charset=UTF-8

Hi all,

I'm stuck with mapping a PKI ClientCertificate from a Smartcard to the
corresponding Active Directory entry using the standard modules and
functionality. The information of how to identify the user in AD is
available in the ClientCertificate, but it seems in a not directly usable
way. Somehow IIS (which is really the last resort) does it somehow with
it's certificate mapping functionality. Probably by converting the
Certificates to the same encoding, but that's just a guess. Here's the
scenario.

1. Authentiaction is done by a ClientCertifikate (mod_ssl). The DN of the
subject is

CN=joe meyer PKI 3423RI324

The last token is a unique employeeID. Of course the whole certificate
is available in PEM encoding in the variable SSL_CLIENT_CERT

2. As far as I understand the ldad_modules, for authorisation I need to
first get the user object from AD (trying with mod_authz_lpad) and then
check for group membership. However, in AD there are only two entries which
can be found in the ClientCertificate: The certificate itself as
attribute userCertificate
and the employeeID, which is the last unique part of the CN. The CN in AD
is a completely different and unrelated, like JWDI2K.

My first attempt was to use the ClientCertificate as SSLUserName

SSLUserName SSL_CLIENT_CERT
...
AuthLDAPURL ldap://ldap.example.com/o=Example?userCertificate

This didn't work. Actually I can only guess due to encoding differences.I
don't know how the certificate in AD is stored. ADSearcher (the Windows
tool) says as octet string.

My second idea is to extract the unique employeeID from the ClientCerficate
and connect to AD via the attribute employeeID. Now, I must confess it's my
first go with Apache and I don't even know if it's conceptionally possible
to set a custom global username based on environment variables and
expressions. Or if the username is by purpose hidden and protected against
such "nasty" hacks.

SSLUserName SSL_CLIENT_S_DN_CN (.SplitAndTakeTheLastToken ... How-To?)
How is SSLUserName to an interally used UserName or REMOTE_USER
related?

AuthLDAPURL ldap://ldap.example.com/o=Example?employeeID

Anyway, I'm stuck. Is there a way to handle this by directives at all or do
I need to use any kind of programming interface to Apache? Unfortunately
I'm quite new to Apache. Are there ways apart from writing modules for
hooking up little scripts?

Cheers,

Jan

--089e01183b60e32b3a0506502968
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div>Hi all,<br><br></div><div>I&#39;m stuck with map=
ping a PKI ClientCertificate from a Smartcard to the corresponding Active D=
irectory entry using the standard modules and functionality. The informatio=
n of how to identify the user in AD is available in the ClientCertificate, =
but it seems in a not directly usable way. Somehow IIS (which is really the=
 last resort) does it somehow with it&#39;s certificate mapping functionali=
ty. Probably by converting the Certificates to the same encoding, but that&=
#39;s just a guess. Here&#39;s the scenario.<br></div><div><br></div>1. Aut=
hentiaction is done by a ClientCertifikate (mod_ssl). The DN of the subject=
 is <br><pre><code>CN=3Djoe meyer PKI 3423RI324</code><span style=3D"font-f=
amily:arial,helvetica,sans-serif"><br><br>The last token is a unique employ=
eeID. Of course the whole certificate is available in PEM encoding in the v=
ariable </span><code>SSL_CLIENT_CERT</code></pre></div><div>2.
As far as I understand the ldad_modules, for authorisation I need to first =
get the user object from AD (trying=20
with mod_authz_lpad) and then check for group membership. However, in AD=20
there are only two entries which can be found in the ClientCertificate:=20
The certificate itself as attribute <span style=3D"font-family:courier new,=
monospace">userCertificate </span>and the <span style=3D"font-family:courie=
r new,monospace">employeeID</span>,=20
which is the last unique part of the CN. The CN in AD is a completely=20
different and unrelated, like <span style=3D"font-family:courier new,monosp=
ace">JWDI2K</span>.<br><br></div><div>My first attempt was to use the Clien=
tCertificate as SSLUserName<br><pre><code>SSLUserName SSL_CLIENT_CERT
...
AuthLDAPURL ldap://<a href=3D"http://ldap.example.com/o=3DExample?userCerti=
ficate" target=3D"_blank">ldap.example.com/o=3DExample?userCertificate</a><=
/code></pre>This
 didn&#39;t work. Actually I can only guess due to encoding differences.I=
=20
don&#39;t know how the certificate in AD is stored. ADSearcher (the Windows=
=20
tool) says as <span style=3D"font-family:courier new,monospace">octet strin=
g</span>.<br><br></div><div>My second idea is to extract the unique <span s=
tyle=3D"font-family:courier new,monospace">employeeID </span>from the Clien=
tCerficate and connect to AD via the attribute <span style=3D"font-family:c=
ourier new,monospace">employeeID</span>. Now, I must confess it&#39;s my fi=
rst go with Apache and I don&#39;t even know if it&#39;s conceptionally pos=
sible to set a custom global username based on environment variables and ex=
pressions. Or if the username is by purpose hidden and protected against su=
ch &quot;nasty&quot; hacks.<br><br><pre><code>SSLUserName SSL_CLIENT_S_DN_C=
N <span style=3D"font-family:courier new,monospace">(.SplitAndTakeTheLastTo=
ken ... How-To?) How is SSLUserName to an interally used UserName or REMOTE=
_USER related?</span></code></pre><pre><code>AuthLDAPURL ldap://<a href=3D"=
http://ldap.example.com/o=3DExample?employeeID" target=3D"_blank">ldap.exam=
ple.com/o=3DExample?employeeID</a></code><br></pre></div><div>Anyway,
 I&#39;m stuck. Is there a way to handle this by directives at all or do I=
=20
need to use any kind of programming interface to Apache? Unfortunately=20
I&#39;m quite new to Apache. Are there ways apart from writing modules for=
=20
hooking up little scripts?<br><br></div><div>Cheers,<br><br></div>Jan</div>

--089e01183b60e32b3a0506502968--