Project

General

Profile

Feature #2415

[patch] Allow $HTTP["remoteuser"] to be used for certificate authorization

Added by zi almost 4 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
-
Target version:
Start date:
2012-04-22
Due date:
% Done:

0%

Estimated time:
0.00 h
Missing in 1.5.x:
No

Description

At the moment, it is possible to require client certificates from a trusted CA. However, there appears to be no way to require a specific certificate for authorization control.

With the attached patch, it is possible to use $HTTP["remoteuser"] in logic decisions by setting:
ssl.verifyclient.username = "SSL_CLIENT_S_DN_CN"
ssl.verifyclient.exportcert = "enable"

Example syntax could be:
$HTTP["url"] =~ "^/cert_required" {
$HTTP["remoteuser"] !~ "my cert CN" {
url.access-deny = ( "" )
}
}

lighttpd-1.4.30-remoteuser.diff Magnifier (2.92 KB) zi, 2012-04-22 19:39

Also available in: Atom