You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@felix.apache.org by Pascal Mainini <pa...@bfh.ch> on 2015/03/05 09:13:45 UTC
Accepting all client certificates (FELIX-4797)
Dear Felix-developers
a few weeks ago, I have submitted a proposal for a patch[1] enabling the
Felix HTTP/Jetty-service to accept any client certificate without doing
further validation of it. The need for it arises in a project I am part
of and is mainly due to the usecase of enabling authentication using
WebID[2].
After a few initial comments, things - as far as I can see - got quiet,
so I decided to bring the issue to this mailinglist - I hope this is the
appropriate place.
Maybe you can give me an update about the current state/processes or
tell me if I need to go into more details etc.
Many thanks in advance, kind regards,
Pascal Mainini
[1] https://issues.apache.org/jira/browse/FELIX-4797
[2] http://www.w3.org/2005/Incubator/webid/spec/tls/
--
Bern University of Applied Sciences
Biel, Switzerland
Re: Accepting all client certificates (FELIX-4797)
Posted by Reto Gmür <re...@wymiwyg.com>.
Hi Carsten,
Ok, I guess 3. is maybe really overkill, especially as we would have to
> introduce an API package for the Jetty implementation (which we
> currently do not have).
>
is actually it can be done in 5 lines of code:
A minimalist
https://issues.apache.org/jira/secure/attachment/12705100/enabling-sslContext-services.patch
would do the job, of course we could handle appearing and disappearing
SSLContext services.
Would such a solution acceptable for all?
Cheers,
Reto
> 1. scares me :) , 2. sounds like a good compromise for me.
>
> What do others think?
>
> Carsten
> --
> Carsten Ziegeler
> Adobe Research Switzerland
> cziegeler@apache.org
>
Re: Accepting all client certificates (FELIX-4797)
Posted by Jan Willem Janssen <ja...@luminis.eu>.
> On 06 Mar 2015, at 11:41, Carsten Ziegeler <cz...@apache.org> wrote:
>
> Am 05.03.15 um 16:06 schrieb Pascal Mainini:
>>
>> I understand your point about the setting beeing dangerous (however I
>> would expect someone configuring authentication with client certificates
>> to be able to grasp the implications of it ;-)
>
> Yeah, that would be ideal :)
>
>>
>> We see the following possibilities:
>> 1. (for completness) patch as-is
>> 2. The patch but without metatype-definitions (thus the feature could
>> not directly be configured over configmgr-gui, needing more
>> interaction from the user)
>> 3. Extend the code to make this injectable as a service
>>
>> What do you think?
>>
>
> Ok, I guess 3. is maybe really overkill, especially as we would have to
> introduce an API package for the Jetty implementation (which we
> currently do not have).
Actually, we have: you could create your own ConnectorFactory in which you
create your own all-trusting SSLContext and add it to your own (SSL-based)
ServerConnector. You could register this connector factory as managed
service as well so you can configure it at runtime if you would like.
> 1. scares me :) , 2. sounds like a good compromise for me.
I still would prefer not to include this patch at all: it is rather hard to
get client certificates properly configured (have been involved in such
situation a couple of times), and IMO this setting would give users a fake
sense of security as it appears that everything is accepted and looks well,
while in fact it isn’t.
--
Met vriendelijke groeten | Kind regards
Jan Willem Janssen | Software Architect
+31 631 765 814
My world is revolving around INAETICS and Amdatu
Luminis Technologies B.V.
Churchillplein 1
7314 BZ Apeldoorn
+31 88 586 46 00
http://www.luminis-technologies.com
http://www.luminis.eu
KvK (CoC) 09 16 28 93
BTW (VAT) NL8169.78.566.B.01
Re: Accepting all client certificates (FELIX-4797)
Posted by Carsten Ziegeler <cz...@apache.org>.
Hi Pascal,
Am 05.03.15 um 16:06 schrieb Pascal Mainini:
>
> I understand your point about the setting beeing dangerous (however I
> would expect someone configuring authentication with client certificates
> to be able to grasp the implications of it ;-)
Yeah, that would be ideal :)
>
> We see the following possibilities:
> 1. (for completness) patch as-is
> 2. The patch but without metatype-definitions (thus the feature could
> not directly be configured over configmgr-gui, needing more
> interaction from the user)
> 3. Extend the code to make this injectable as a service
>
> What do you think?
>
Ok, I guess 3. is maybe really overkill, especially as we would have to
introduce an API package for the Jetty implementation (which we
currently do not have).
1. scares me :) , 2. sounds like a good compromise for me.
What do others think?
Carsten
--
Carsten Ziegeler
Adobe Research Switzerland
cziegeler@apache.org
Re: Accepting all client certificates (FELIX-4797)
Posted by Pascal Mainini <pa...@bfh.ch>.
Hi Carsten
thanks a lot for the fast reply!
> as noted in the issue this is a very dangerous setting - it might be ok
> in your use case, but in general you definitely don't want to do this.
> Therefore I'm a little bit reluctant to add such a general setting.
I understand your point about the setting beeing dangerous (however I
would expect someone configuring authentication with client certificates
to be able to grasp the implications of it ;-)
> I like the idea from Reto to make this pluggable via a service. In this
> case you can still provide your own implementation but for everyone else
> it gets harder to shoot themselves in the foot.
The main reason why we have implemented the patch directly into the HTTP
service is simplicity (for understanding/accepting the patch as well as
for the user), it also results in less modification of code which we
thought would be more safe. Also, from a user perspective, we think that
having a pluggable service leads to more complexity which could as well
be more unsafe. So far our thoughts.
We see the following possibilities:
1. (for completness) patch as-is
2. The patch but without metatype-definitions (thus the feature could
not directly be configured over configmgr-gui, needing more
interaction from the user)
3. Extend the code to make this injectable as a service
What do you think?
Many thanks and kind regards,
Pascal
--
Bern University of Applied Sciences
Biel, Switzerland
Re: Accepting all client certificates (FELIX-4797)
Posted by Carsten Ziegeler <cz...@apache.org>.
Am 05.03.15 um 09:13 schrieb Pascal Mainini:
> Dear Felix-developers
>
> a few weeks ago, I have submitted a proposal for a patch[1] enabling the
> Felix HTTP/Jetty-service to accept any client certificate without doing
> further validation of it. The need for it arises in a project I am part
> of and is mainly due to the usecase of enabling authentication using
> WebID[2].
>
> After a few initial comments, things - as far as I can see - got quiet,
> so I decided to bring the issue to this mailinglist - I hope this is the
> appropriate place.
>
> Maybe you can give me an update about the current state/processes or
> tell me if I need to go into more details etc.
>
Hi,
as noted in the issue this is a very dangerous setting - it might be ok
in your use case, but in general you definitely don't want to do this.
Therefore I'm a little bit reluctant to add such a general setting.
I like the idea from Reto to make this pluggable via a service. In this
case you can still provide your own implementation but for everyone else
it gets harder to shoot themselves in the foot.
Carsten
--
Carsten Ziegeler
Adobe Research Switzerland
cziegeler@apache.org