DokuWiki

It's better when it's simple

User Tools

Site Tools


plugin:authclientcert

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision
Previous revision
plugin:authclientcert [2019-02-15 13:53] – created paweljasinskiplugin:authclientcert [2019-10-25 10:12] (current) Dr-Yukon
Line 1: Line 1:
-====== authclientcert Plugin ======+====== AuthClientCert Plugin ======
  
 ---- plugin ---- ---- plugin ----
-description: authenticate and create user from client x509 certificate +description: Authenticate and create user from client x509 certificate 
-author     : paweljasinski+author     : Pawel Jasinski
 email      : pawel.jasinski@gmail.com email      : pawel.jasinski@gmail.com
 type       : auth type       : auth
-lastupdate : 2019-02-15+lastupdate : 2019-03-30
 compatible : Greebo compatible : Greebo
 depends    : authplain depends    : authplain
-conflicts  :+conflicts authchained
 similar    : authhttp, authremoteuser similar    : authhttp, authremoteuser
 tags       : authentication x509 smartcard tags       : authentication x509 smartcard
  
-downloadurl: http://github.com/paweljasinski/dokuwiki-plugin-authclientcert/zipball/master +downloadurl: https://github.com/paweljasinski/dokuwiki-plugin-authclientcert/zipball/master 
-bugtracker : http://github.com/paweljasinski/dokuwiki-plugin-authclientcert/issues +bugtracker : https://github.com/paweljasinski/dokuwiki-plugin-authclientcert/issues 
-sourcerepo : http://github.com/paweljasinski/dokuwiki-plugin-authclientcert/+sourcerepo : https://github.com/paweljasinski/dokuwiki-plugin-authclientcert
 donationurl: donationurl:
  
Line 23: Line 23:
 ===== Description ===== ===== Description =====
  
-This plugin authenticate user based on content of client certificate provided by reverse proxy or web server. The certificate is picked up from _SERVER variable. Either SSL_CLIENT_CERT or any HTTP header can be configured as source of certificate. This plugin expects certificate in PEM format. The BEGIN/END CERTIFICATE fields are optional.+This plugin authenticate user based on content of client certificate provided by reverse proxy or web server. The certificate is picked up from the _SERVER variable. Either SSL_CLIENT_CERT or any HTTP header can be configured as source of certificate. This plugin expects certificate in PEM format. The BEGIN/END CERTIFICATE fields are optional.
  
-The certificate validation must be performed by web server or reverse proxy. Certificates delivered to this plugin are assumed valid.+This plugin does not perform any certificate validation. It is up to the configured web server or reverse proxy to validate the certificate before passing it.
  
 The following table shows mapping between certificate fields and user info. The following table shows mapping between certificate fields and user info.
  
-^Certificate  ^User Info| +^ Certificate  ^ User Info  ^ 
-|name employeeNumber (OID:2.16.840.1.113730.3.1.3)  |user| +| name employeeNumber (OID:2.16.840.1.113730.3.1.3)  | user((User name is sanitized the same way as in authplain plugin -- e.g. all character are converted to lowercase.))  
-|extensions subjectAltName email  |email| +| extensions subjectAltName email  |email  
-|subject CN | real name|+| subject CN  | real name|
  
 +If the certificate is present and all of the above fields are not empty, a user is logged in. New users are created on the first login - random passwords are generated for consistency.
  
-If the certificate is present and all of the above fields are not empty, user is logged in. New users are created on first login - random password is generated for consistency. +Logging out and profile editing are disabled. Howeverthe administrator can modify group membership or delete user.
-authclientcert uses authplain as backend storage.+
  
 +Authclientcert plugin uses [[plugin:authplain]] as back-end storage.
  
 ===== Installation ===== ===== Installation =====
  
-Install the plugin using the [[plugin:plugin|Plugin Manager]] and the download URL above, which points to latest version of the plugin. Refer to [[:Plugins]] on how to install plugins manually. +  * Install the plugin using the [[plugin:plugin|Plugin Manager]] and the download URL above, which points to latest version of the plugin. Refer to [[:Plugins]] on how to install plugins manually. 
- +  Disable anonymous access and self registration 
-Disable anonymous access and self registration +  Select plugin as a authentication backend 
- +  Configure reverse proxy to validate and deliver certificate in X_SSL_CLIENTCERT_BASE64 header 
-Select plugin as a authentication backend +  Configure name of http header where certificate is delivered HTTP_X_SSL_CLIENTCERT_BASE64 
- +  Configure name of the group where new users are assigned.
-Configure reverse proxy to validate and deliver certificate in X_SSL_CLIENTCERT_BASE64 header +
- +
-Configure name of http header where certificate is delivered HTTP_X_SSL_CLIENTCERT_BASE64 +
- +
-Configure name of the group where new users are assigned. +
  
 ===== Development ===== ===== Development =====
Line 58: Line 53:
 === Change Log === === Change Log ===
  
-  * **2019-02-15**+  * **2019-02-16**
     * Initial release     * Initial release
 +  * **2019-03-30**
 +    * It is allowed to delete a user
 +    * If login is password based, logout is enabled
  
 === Known Bugs and Issues === === Known Bugs and Issues ===
  
-This plugin does not work with authchained.+This plugin does not work with [[plugin:authchained|authchained]].
  
 === ToDo/Wish List === === ToDo/Wish List ===
  
 The selection of the fields and mapping is hard coded to match content of a smartcard I have. It is very likely that the selection does not match your cetificate. The selection of the fields and mapping is hard coded to match content of a smartcard I have. It is very likely that the selection does not match your cetificate.
-The easiest way to adjust itedit plugins auth.php.+ 
 +The easiest way to adjust it is to edit plugins auth.php. 
 Long term it make sense to capture most common cases as configuration. Please, let me know about your needs by opening an issue at [[https://github.com/paweljasinski/dokuwiki-plugin-authclientcert/issues|Github]], or even better create a PR. Long term it make sense to capture most common cases as configuration. Please, let me know about your needs by opening an issue at [[https://github.com/paweljasinski/dokuwiki-plugin-authclientcert/issues|Github]], or even better create a PR.
- 
  
 ===== FAQ ===== ===== FAQ =====
- 
  
 ===== Discussion ===== ===== Discussion =====
- 
- 
- 
  
plugin/authclientcert.1550235195.txt.gz · Last modified: 2019-02-15 13:53 by paweljasinski

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki