Changes between Initial Version and Version 1 of SslAuthenticationPlugin

Timestamp:

Apr 26, 2008, 8:30:53 PM (16 years ago)

Author:

Giel van Schijndel

Comment:

New hack SslAuthenticationPlugin, created by giel

SslAuthenticationPlugin

@@ +1 @@
+= SSL Authentication =
+
+== Description ==
+
+This plugin allows authentication of users by making use of SSL client certificates.
+
+== Bugs/Feature Requests == 
+
+Existing bugs and feature requests for SslAuthenticationPlugin are 
+[report:9?COMPONENT=SslAuthenticationPlugin here].
+
+If you have any issues, create a 
+[http://trac-hacks.org/newticket?component=SslAuthenticationPlugin&owner=giel new ticket].
+
+== Download ==
+
+Download the zipped source from [download:sslauthenticationplugin here].
+
+== Source ==
+
+You can check out SslAuthenticationPlugin from [http://trac-hacks.org/svn/sslauthenticationplugin here] using Subversion, or [source:sslauthenticationplugin browse the source] with Trac.
+
+== Example ==
+
+Currently a small patch is required to be applied against Trac in order to get this working (this patch is against 10.4-2, the -2 represents a Debian package revision):
+{{{
+#!diff
+diff -Nur /usr/share/python-support/trac/trac/web/main.py /var/lib/python-support/python2.4/trac/web/main.py
+--- /usr/share/python-support/trac/trac/web/main.py     2007-05-30 03:23:40.000000000 +0200
++++ /var/lib/python-support/python2.4/trac/web/main.py  2008-04-26 21:55:45.000000000 +0200
+@@ -180,7 +180,13 @@
+             if not getattr(chosen_handler, 'anonymous_request', False):
+                 try:
+                     req.authname = self.authenticate(req)
+-                    req.perm = PermissionCache(self.env, req.authname)
++                    try:
++                        if req.perm_user:
++                            req.perm = PermissionCache(self.env, req.perm_user)
++                        else:
++                            req.perm = PermissionCache(self.env, req.authname)
++                    except:
++                        req.perm = PermissionCache(self.env, req.authname)
+                     req.session = Session(self.env, req)
+                     req.form_token = self._get_form_token(req)
+                 except:
+}}}
+
+When this patch is applied you can use a virtual host config section similar to this (assuming you're using Apache):
+{{{
+#!apache
+<VirtualHost *:443>
+    ServerName trac.example.org
+
+    Alias /chrome/common /usr/share/trac/htdocs
+
+    SSLEngine on
+    SSLCertificateFile /etc/apache2/ssl/trac.example.org_publickey.pem
+    SSLCertificateKeyFile /etc/apache2/ssl/trac.example.org_privatekey.pem
+    # I use CACert's root certificate, you can get it from here: http://www.cacert.org/index.php?id=3
+    SSLCACertificateFile /etc/apache2/ssl/CACert_class_1_and_3.pem
+
+    SSLVerifyClient none
+    SSLOptions -StrictRequire
+
+    <Directory "/usr/share/trac/htdocs">
+        Options Indexes MultiViews
+        AllowOverride None
+        Order allow,deny
+        Allow from all
+    </Directory>
+
+    <Location "/test">
+        SetHandler mod_python
+        PythonHandler trac.web.modpython_frontend
+        PythonOption TracEnv /var/trac/test
+        PythonOption TracUriRoot /personal/
+
+        # Authentication
+        # Require SSL connection to access this location
+        SSLRequireSSL
+
+        # Requires client verification, and verifies up to 2 intermediary CAs
+        SSLVerifyClient optional
+        SSLVerifyDepth 2
+
+        # Creates additional environment variables including client certificate data
+        SSLOptions +StdEnvVars
+        # Requires the above SSLRequireSSL directive to be succesfull as well as
+        # the SSLRequire directive below, if it isn't succesfull Apache will
+        # refuse access to this page.
+        SSLOptions +StrictRequire
+
+        # Requires, that the client's CN and e-mail in the certificates equals one of the below
+        SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
+    </Location>
+
+    # Lets still allow basic HTTP authentication
+    <Location "/test/login">
+        AuthType Basic
+        AuthName "Test Trac"
+        AuthUserFile /etc/apache2/passwd/trac.example.org/test.passwd
+        Require valid-user
+    </Location>
+
+    CustomLog /var/log/apache2/trac.example.org/access.log combined
+    ErrorLog /var/log/apache2/trac.example.org/error.log
+</VirtualHost>
+}}}
+
+If the plugin is installed and enabled, and the patch is applied, you will be able to automatically log in with the email address in your browser's client certificate.
+
+You can create yourself a client certificate at [http://cacert.org/ CACert].
+
+== Recent Changes ==
+
+[[ChangeLog(sslauthenticationplugin, 3)]]
+
+== Author/Contributors ==
+
+'''Author:''' [wiki:giel] [[BR]]
+'''Contributors:'''