DokuWiki

It's better when it's simple

User Tools

Site Tools


plugin:authclientcert

authclientcert Plugin

Compatible with DokuWiki

  • 2018-04-22 "Greebo" yes
  • 2017-02-19 "Frusterick Manners" unknown
  • 2016-06-26 "Elenor Of Tsort" unknown
  • 2015-08-10 "Detritus" unknown

plugin authenticate and create user from client x509 certificate

Last updated on
2019-02-16
Provides
Auth
Repository
Source
Requires
authplain

Description

This plugin authenticate user based on content of client certificate provided by a reverse proxy or a web server. The certificate is picked up from the _SERVER variable. Either SSL_CLIENT_CERT or any HTTP header can be configured as a source of certificate. This plugin expects certificate in PEM format. The BEGIN/END CERTIFICATE fields are optional.

This plugin does not perform any certificate validation. It is up to the configured web server or reverse proxy to validate the certificate before passing it.

The following table shows mapping between certificate fields and user info.

Certificate User Info
name employeeNumber (OID:2.16.840.1.113730.3.1.3) user*
extensions subjectAltName email email
subject CN real name

* User name is sanitized the same way as in authplain plugin - e.g. all character are converted to lowercase.

If the certificate is present and all of the above fields are not empty, a user is logged in. New users are created on the first login - random passwords are generated for consistency. Logging out and profile editing are disabled. However, the administrator can modify group membership or delete a user.

Authclientcert plugin uses authplain as backend storage.

Installation

  • Install the plugin using the Plugin Manager and the download URL above, which points to latest version of the plugin. Refer to Plugins on how to install plugins manually.
  • Disable anonymous access and self registration
  • Select plugin as a authentication backend
  • Configure reverse proxy to validate and deliver certificate in X_SSL_CLIENTCERT_BASE64 header
  • Configure name of http header where certificate is delivered HTTP_X_SSL_CLIENTCERT_BASE64
  • Configure name of the group where new users are assigned.

Development

Change Log

  • 2019-02-16
    • Initial release

Known Bugs and Issues

This plugin does not work with authchained.

ToDo/Wish List

The selection of the fields and mapping is hard coded to match content of a smartcard I have. It is very likely that the selection does not match your cetificate. The easiest way to adjust it is to edit plugins auth.php.

Long term it make sense to capture most common cases as configuration. Please, let me know about your needs by opening an issue at Github, or even better create a PR.

FAQ

Discussion

plugin/authclientcert.txt · Last modified: 2019-02-17 10:50 by paweljasinski