You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by "Martin v. Löwis" <ma...@v.loewis.de> on 2003/06/18 18:38:00 UTC
Announcing mod_ssl_user
I have just published release 1.0 of mod_ssl_user, at
http://www.dcl.hpi.uni-potsdam.de/home/loewis/mod_ssl_user.c
This module allows to set the user field in an Apache request object,
if a user has been authenticated through SSL. It is configurable
through a mod_ssl variable name, such as SSL_CLIENT_S_DN_CN.
With that module, Subversion will write proper author information in
commit messages.
Any comments appreciated.
Regards,
Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by "Martin v. Löwis" <ma...@v.loewis.de>.
Colin Watson <cj...@flatline.org.uk> writes:
> I usually prefer to see usernames in commit messages because, when I'm
> working in technical contexts, I think of people by their usernames.
> Plus, as above, it's clearly a far more correct choice of primary key.
> Annotating with the real name would be fine if it's manageable.
Certainly. If Debian would start to use SSL client authentication for
Subversion, some sort of solution would have to be found. There would
need to be a decision whether Debian would use its own CA, or whether
it would accept "foreign" certificates (e.g. from Verisign).
If Debian would use its own CA, the user DNs could be constructed
up-front to include the user-id (0.9.2342.19200300.100.1.1) in the CN,
and then use
SSLUserName SSL_CLIENT_S_DN_userID
If Debian would accept arbitrary certificates (from a set of trusted
CAs), there would be no choice but to use FakeBasicAuth, which would
then set the username to the full DN - I'm certain that the two users
with the same common name would still have different DNs. At that
point, enhancing the FakeBasicAuth mechanism to include a mapping to
local user names might be appropriate.
In neither case, additional attributes in the certificate would be
used. In the first case, it would not be needed, since constructing
the DNs so that they really identify the user uniquely seems
desirable. In the second case, it could not be used, since the foreign
CA just would not provide certificates that include Debian user names.
Regards,
Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by Colin Watson <cj...@flatline.org.uk>.
On Fri, Jun 20, 2003 at 08:34:48PM +0200, Martin v. L?wis wrote:
> Mukund <mu...@tessna.com> writes:
> > Personally, I would like an option to use an extension to specify
> > the username in client certificates rather than fields in the subject DN.
> > This is because we already use the fields in the subject DN (CN to indicate
> > the real name of the person for example).
>
> Well, we have apparently different ideas of what a user name is. To
> me, the "real name of the person" is a much better user name than
> any "username". For example, having the real name of the person show
> up in 'svn log' is much better than having its userid being logged.
>
> So I set
>
> SSLUserName SSL_CLIENT_S_DN_CN
>
> in httpd.conf, and get all users logged with their real names. Why
> would I want to log account names instead?
Debian has two developers with the same real name (even if you include
middle names). They have different usernames, though.
I usually prefer to see usernames in commit messages because, when I'm
working in technical contexts, I think of people by their usernames.
Plus, as above, it's clearly a far more correct choice of primary key.
Annotating with the real name would be fine if it's manageable.
--
Colin Watson [cjwatson@flatline.org.uk]
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by "Martin v. Löwis" <ma...@v.loewis.de>.
Mukund <mu...@tessna.com> writes:
> Personally, I would like an option to use an extension to specify
> the username in client certificates rather than fields in the subject DN.
> This is because we already use the fields in the subject DN (CN to indicate
> the real name of the person for example).
Well, we have apparently different ideas of what a user name is. To
me, the "real name of the person" is a much better user name than
any "username". For example, having the real name of the person show
up in 'svn log' is much better than having its userid being logged.
So I set
SSLUserName SSL_CLIENT_S_DN_CN
in httpd.conf, and get all users logged with their real names. Why
would I want to log account names instead?
> Does mod_ssl support reading extension fields into environment variables?
There is an environment variable copying the entire certificate, if
you want that. Copying specific extension fields is not supported.
Regards,
Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by Mukund <mu...@tessna.com>.
On Thu, Jun 19, 2003 at 10:19:31PM +0200, Martin v. Löwis wrote:
| That does something completely different, though. In a Thawte
| certificate, there is apparently some X.509 extension (1.3.101.1.4.1),
| which contains some kind of user identification. They don't support
| setting the user to the subject DN, or part of it.
Does it do something completely different?
The work you have done is good.
Personally, I would like an option to use an extension to specify
the username in client certificates rather than fields in the subject DN.
This is because we already use the fields in the subject DN (CN to indicate
the real name of the person for example).
Does mod_ssl support reading extension fields into environment variables?
Mukund
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by "Martin v. Löwis" <ma...@v.loewis.de>.
Mukund <mu...@tessna.com> writes:
> On Thu, Jun 19, 2003 at 11:15:11AM +0100, Mukund wrote:
> | I can't help thinking -- this kind of module/code was available
> | someplace, as a part of the mod_ssl distribution or openssl as some code
> | from Thawte or some other CA. They obviously had code which would only work
> | with their CA signed certificates, but source code was provided with
> | mod_ssl or openssl and the CA sign checking could be patched out or
> | modified to check against a local CA cert.
>
> It's a part of the mod_ssl distribution in pkg.contrib/sxnet.tar
That does something completely different, though. In a Thawte
certificate, there is apparently some X.509 extension (1.3.101.1.4.1),
which contains some kind of user identification. They don't support
setting the user to the subject DN, or part of it.
Regards,
Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by Mukund <mu...@tessna.com>.
On Thu, Jun 19, 2003 at 11:15:11AM +0100, Mukund wrote:
| I can't help thinking -- this kind of module/code was available
| someplace, as a part of the mod_ssl distribution or openssl as some code
| from Thawte or some other CA. They obviously had code which would only work
| with their CA signed certificates, but source code was provided with
| mod_ssl or openssl and the CA sign checking could be patched out or
| modified to check against a local CA cert.
It's a part of the mod_ssl distribution in pkg.contrib/sxnet.tar
Mukund
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by Mukund <mu...@tessna.com>.
On Wed, Jun 18, 2003 at 08:38:00PM +0200, Martin v. Löwis wrote:
| I have just published release 1.0 of mod_ssl_user, at
|
| http://www.dcl.hpi.uni-potsdam.de/home/loewis/mod_ssl_user.c
|
| This module allows to set the user field in an Apache request object,
| if a user has been authenticated through SSL. It is configurable
| through a mod_ssl variable name, such as SSL_CLIENT_S_DN_CN.
|
I can't help thinking -- this kind of module/code was available
someplace, as a part of the mod_ssl distribution or openssl as some code
from Thawte or some other CA. They obviously had code which would only work
with their CA signed certificates, but source code was provided with
mod_ssl or openssl and the CA sign checking could be patched out or
modified to check against a local CA cert.
Mukund
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by "Martin v. Löwis" <ma...@v.loewis.de>.
Daniel Patterson <da...@adaptiveinternational.com> writes:
> Heh. Check the manaul page for mod_ssl and FakeBasicAuth. You still
> need an "AuthType Basic", "AuthUserFile x" directive to authorize those
> usernames. FakeBasicAuth sets a fixed password which you apply to all
> theusers in your htpasswd file.
See my bug report, at
http://subversion.tigris.org/issues/show_bug.cgi?id=1364
I did all that, and a number of requests where authenticated and
authorized just fine. Only when it comes to MERGE, it fails.
Did you actually try this, or are you just assuming it should work?
Regards,
Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by Daniel Patterson <da...@adaptiveinternational.com>.
On Thu, 2003-06-19 at 18:38, Martin v. Löwis wrote:
> "Sander Striker" <st...@apache.org> writes:
>
> > > Can't the existing "SSLOption FakeBasicAuth" be used to achieve this
> > > also?
> >
> > Not flexible enough. Unless you want authors that look like DNs...
>
> Not only that: It does not work at all. Authorization succeeds fine,
> req->user gets set, subversion accepts a number of actions (OPTIONS,
> MKACTIVITY, PROPFIND, CHECKOUT, PUT), and then fails with
>
> svn: Commit failed (details follow):
> svn: MERGE request failed on '/svn'
> svn: MERGE of '/svn': 403 Forbidden (https://localhost)
Heh. Check the manaul page for mod_ssl and FakeBasicAuth. You still
need an "AuthType Basic", "AuthUserFile x" directive to authorize those
usernames. FakeBasicAuth sets a fixed password which you apply to all
theusers in your htpasswd file.
But, as Sander said, the username is stuck as the DN.
daniel
--
Signature at: http://www.mel.au.adaptiveinternational.com/~danpat/signature.txt
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by "Martin v. Löwis" <ma...@v.loewis.de>.
"Sander Striker" <st...@apache.org> writes:
> > Can't the existing "SSLOption FakeBasicAuth" be used to achieve this
> > also?
>
> Not flexible enough. Unless you want authors that look like DNs...
Not only that: It does not work at all. Authorization succeeds fine,
req->user gets set, subversion accepts a number of actions (OPTIONS,
MKACTIVITY, PROPFIND, CHECKOUT, PUT), and then fails with
svn: Commit failed (details follow):
svn: MERGE request failed on '/svn'
svn: MERGE of '/svn': 403 Forbidden (https://localhost)
And indeed, access_log reads
...
127.0.0.1 - /C=DE/L=Potsdam/O=Hasso-Plattner-Institut/OU=OSM/CN=Martin von Loewis/Email=Martin.vonLoewis@hpi.uni-potsdam.de [19/Jun/2003:10:20:16 +0200] "PROPPATCH /svn/!svn/wbl/6f6564ad-6fc0-0310-9c4a-cc067b7061e6/4 HTTP/1.1" 207 348
127.0.0.1 - /C=DE/L=Potsdam/O=Hasso-Plattner-Institut/OU=OSM/CN=Martin von Loewis/Email=Martin.vonLoewis@hpi.uni-potsdam.de [19/Jun/2003:10:20:16 +0200] "PROPFIND /svn HTTP/1.1" 207 356
127.0.0.1 - /C=DE/L=Potsdam/O=Hasso-Plattner-Institut/OU=OSM/CN=Martin von Loewis/Email=Martin.vonLoewis@hpi.uni-potsdam.de [19/Jun/2003:10:20:16 +0200] "CHECKOUT /svn/!svn/ver/4/y.c HTTP/1.1" 201 361
127.0.0.1 - /C=DE/L=Potsdam/O=Hasso-Plattner-Institut/OU=OSM/CN=Martin von Loewis/Email=Martin.vonLoewis@hpi.uni-potsdam.de [19/Jun/2003:10:20:17 +0200] "PUT /svn/!svn/wrk/6f6564ad-6fc0-0310-9c4a-cc067b7061e6/y.c HTTP/1.1" 204 0
127.0.0.1 - /C=DE/L=Potsdam/O=Hasso-Plattner-Institut/OU=OSM/CN=Martin von Loewis/Email=Martin.vonLoewis@hpi.uni-potsdam.de [19/Jun/2003:10:20:17 +0200] "MERGE /svn HTTP/1.1" 403 302
This is now issue 1364.
Regards,
Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
RE: Announcing mod_ssl_user
Posted by Sander Striker <st...@apache.org>.
> From: Daniel Patterson [mailto:danpat@adaptiveinternational.com]
> Sent: Thursday, June 19, 2003 12:14 AM
> On Thu, 2003-06-19 at 05:07, Ben Collins-Sussman wrote:
> > martin@v.loewis.de (Martin v. Löwis) writes:
> > > This module allows to set the user field in an Apache request object,
> > > if a user has been authenticated through SSL. It is configurable
> > > through a mod_ssl variable name, such as SSL_CLIENT_S_DN_CN.
> > >
> > > With that module, Subversion will write proper author information in
> > > commit messages.
> >
> > So this means that Subversion repositories no longer need to require
> > "Basic Auth" credentials over SSL? They have other options now?
>
> Can't the existing "SSLOption FakeBasicAuth" be used to achieve this
> also?
>
> (albeit, not as flexible, but it has existed for a long time)
Not flexible enough. Unless you want authors that look like DNs...
Sander
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by Daniel Patterson <da...@adaptiveinternational.com>.
On Thu, 2003-06-19 at 05:07, Ben Collins-Sussman wrote:
> martin@v.loewis.de (Martin v. Löwis) writes:
> > This module allows to set the user field in an Apache request object,
> > if a user has been authenticated through SSL. It is configurable
> > through a mod_ssl variable name, such as SSL_CLIENT_S_DN_CN.
> >
> > With that module, Subversion will write proper author information in
> > commit messages.
>
> So this means that Subversion repositories no longer need to require
> "Basic Auth" credentials over SSL? They have other options now?
Can't the existing "SSLOption FakeBasicAuth" be used to achieve this
also?
(albeit, not as flexible, but it has existed for a long time)
daniel
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by "Martin v. Löwis" <ma...@v.loewis.de>.
Ben Collins-Sussman <su...@collab.net> writes:
> So this means that Subversion repositories no longer need to require
> "Basic Auth" credentials over SSL? They have other options now?
It was always the case that you can use SSL client authentication over
mod_dav_svn. For example, our repository had for quite some time
SSLRequire %{SSL_CLIENT_I_DN} eq "/C=DE/L=Potsdam/O=Hasso-Plattner-Institut/OU=OSM/CN=HPI OSM Client Authentication CA" && \
%{SSL_CLIENT_S_DN_CN} in { \
"Martin von Loewis", "Peter Troeger", "Michael Dirska"}
This would allow access to all the listed users (assuming that our CA
always fills out the CN properly, which it does).
So far, even though authentication succeeded properly, Subversion
would log "(no author)", meaning that users would have to provide
Basic auth *on top of that*. This was very unfortunate, since users
were already authenticated...
With that module, no need for transmitting passwords exists anymore;
just authenticating with the SSL certificate is sufficient.
Now, if I could get SVN to use the Windows CryptoAPI certificate
storage, instead of requiring PKCS12 files read by OpenSSL...
Regards,
Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by Ben Collins-Sussman <su...@collab.net>.
martin@v.loewis.de (Martin v. Löwis) writes:
> I have just published release 1.0 of mod_ssl_user, at
>
> http://www.dcl.hpi.uni-potsdam.de/home/loewis/mod_ssl_user.c
>
> This module allows to set the user field in an Apache request object,
> if a user has been authenticated through SSL. It is configurable
> through a mod_ssl variable name, such as SSL_CLIENT_S_DN_CN.
>
> With that module, Subversion will write proper author information in
> commit messages.
So this means that Subversion repositories no longer need to require
"Basic Auth" credentials over SSL? They have other options now?
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by "Martin v. Löwis" <ma...@v.loewis.de>.
Joe Orton <jo...@manyfish.co.uk> writes:
> Nice work - you could probably do this using ssl_var_lookup() to avoid
> the dependency on +StdEnvVars
That does not work, see
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=20852
Regards,
Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by Joe Orton <jo...@manyfish.co.uk>.
On Wed, Jun 18, 2003 at 08:38:00PM +0200, Martin v. Löwis wrote:
> I have just published release 1.0 of mod_ssl_user, at
>
> http://www.dcl.hpi.uni-potsdam.de/home/loewis/mod_ssl_user.c
>
> This module allows to set the user field in an Apache request object,
> if a user has been authenticated through SSL. It is configurable
> through a mod_ssl variable name, such as SSL_CLIENT_S_DN_CN.
>
> With that module, Subversion will write proper author information in
> commit messages.
Nice work - you could probably do this using ssl_var_lookup() to avoid
the dependency on +StdEnvVars, but it would be just as useful to simply
patch this into mod_ssl itself if you felt inspired to write and submit
patches. ;)
joe
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
RE: Announcing mod_ssl_user
Posted by Sander Striker <st...@apache.org>.
> From: Greg Stein [mailto:gstein@lyra.org]
> Sent: Thursday, June 19, 2003 12:33 AM
> On Wed, Jun 18, 2003 at 11:54:16PM +0200, Sander Striker wrote:
> > > From: martin@v.loewis.de [mailto:martin@v.loewis.de]
> > > Sent: Wednesday, June 18, 2003 10:51 PM
> >...
> > > That said, I'd appreciate a review, and I'm certainly willing to
> > > produce a patch to incorporate the feature directly into mod_ssl. For
> > > that approach, I observe that
> >...
> > Incorporating with mod_ssl seems to be the way to go for now.
>
> Martin has done some great work. Woo!
>
> Now people are volunteering him for more work? How about another volunteer
> to construct patches for mod_ssl?
Fair enough. I'll add it to my queue.
Sander
Warning: my queue is pretty long.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by Greg Stein <gs...@lyra.org>.
On Wed, Jun 18, 2003 at 11:54:16PM +0200, Sander Striker wrote:
> > From: martin@v.loewis.de [mailto:martin@v.loewis.de]
> > Sent: Wednesday, June 18, 2003 10:51 PM
>...
> > That said, I'd appreciate a review, and I'm certainly willing to
> > produce a patch to incorporate the feature directly into mod_ssl. For
> > that approach, I observe that
>...
> Incorporating with mod_ssl seems to be the way to go for now.
Martin has done some great work. Woo!
Now people are volunteering him for more work? How about another volunteer
to construct patches for mod_ssl?
Cheers,
-g
--
Greg Stein, http://www.lyra.org/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by "Martin v. Löwis" <ma...@v.loewis.de>.
"Sander Striker" <st...@apache.org> writes:
> > Your (or somebody elses) original suggestion was to write
> > mod_auth_ssl,
>
> mod_authn_ssl, yes.
If 'n' means authentication here, I probably miss the point: mod_ssl
already does authentication, no?
> > b) setting req->user is not possible inside the check_user_id
> > hook, as mod_ssl sets the environment variables only in the
> > fixup hook (where mod_ssl_user installs).
>
> That isn't the only problem ;). The authn/authz hooks are only
> called when there is a Require line present. This is a problem
> we recognize, but it'll take some time for us to sort it out.
I was working around that by putting 'require valid-user' into the
configuration, which worked fine for me.
> Incorporating with mod_ssl seems to be the way to go for now.
Ok. I will try that next.
Regards,
Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by "Martin v. Löwis" <ma...@v.loewis.de>.
"Sander Striker" <st...@apache.org> writes:
> Incorporating with mod_ssl seems to be the way to go for now.
It is now submitted to Apache as
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=20957
Regards,
Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
RE: Announcing mod_ssl_user
Posted by Sander Striker <st...@apache.org>.
> From: martin@v.loewis.de [mailto:martin@v.loewis.de]
> Sent: Wednesday, June 18, 2003 10:51 PM
> "Sander Striker" <st...@apache.org> writes:
>
> > I have yet to review, but you might consider offering it for inclusion
> > in httpd-2.x (if you can live with the ASF license).
>
> Your (or somebody elses) original suggestion was to write
> mod_auth_ssl,
mod_authn_ssl, yes.
> which would also do authentication
Yes.
> (e.g. by means of require user <list of DN_CNs>
No. Satisfying Require lines would be authorization (authz).
> ). This turned out to be unimplementable, and partially useless,
> because
> a) SSLRequire is already available and much more powerful than
> any authorization based on solely req->user, and
See above. Wasn't suggesting this.
> b) setting req->user is not possible inside the check_user_id
> hook, as mod_ssl sets the environment variables only in the
> fixup hook (where mod_ssl_user installs).
That isn't the only problem ;). The authn/authz hooks are only
called when there is a Require line present. This is a problem
we recognize, but it'll take some time for us to sort it out.
> That said, I'd appreciate a review, and I'm certainly willing to
> produce a patch to incorporate the feature directly into mod_ssl. For
> that approach, I observe that
> c) mod_ssl_user might be still useful for users of older mod_ssl
> installations, and
> d) SSLUserName <single variable name>
> might be insufficient. Some authorized users may have a CN set,
> others might only have a USERID. So I have considering a syntax
> like
> SSLUserName VAR or VAR
> with the Python semantics for "or". User feedback will hopefully
> indicate whether this is really needed, or considered overkill.
Incorporating with mod_ssl seems to be the way to go for now.
Sander
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Announcing mod_ssl_user
Posted by "Martin v. Löwis" <ma...@v.loewis.de>.
"Sander Striker" <st...@apache.org> writes:
> I have yet to review, but you might consider offering it for inclusion
> in httpd-2.x (if you can live with the ASF license).
Your (or somebody elses) original suggestion was to write
mod_auth_ssl, which would also do authentication (e.g. by means of
require user <list of DN_CNs>
). This turned out to be unimplementable, and partially useless,
because
a) SSLRequire is already available and much more powerful than
any authorization based on solely req->user, and
b) setting req->user is not possible inside the check_user_id
hook, as mod_ssl sets the environment variables only in the
fixup hook (where mod_ssl_user installs).
That said, I'd appreciate a review, and I'm certainly willing to
produce a patch to incorporate the feature directly into mod_ssl. For
that approach, I observe that
c) mod_ssl_user might be still useful for users of older mod_ssl
installations, and
d) SSLUserName <single variable name>
might be insufficient. Some authorized users may have a CN set,
others might only have a USERID. So I have considering a syntax
like
SSLUserName VAR or VAR
with the Python semantics for "or". User feedback will hopefully
indicate whether this is really needed, or considered overkill.
Regards,
Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
RE: Announcing mod_ssl_user
Posted by Sander Striker <st...@apache.org>.
> From: martin@v.loewis.de [mailto:martin@v.loewis.de]
> Sent: Wednesday, June 18, 2003 8:38 PM
> I have just published release 1.0 of mod_ssl_user, at
>
> http://www.dcl.hpi.uni-potsdam.de/home/loewis/mod_ssl_user.c
>
> This module allows to set the user field in an Apache request object,
> if a user has been authenticated through SSL. It is configurable
> through a mod_ssl variable name, such as SSL_CLIENT_S_DN_CN.
>
> With that module, Subversion will write proper author information in
> commit messages.
>
> Any comments appreciated.
I have yet to review, but you might consider offering it for inclusion
in httpd-2.x (if you can live with the ASF license).
Mail dev@httpd.apache.org.
Sander
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org