Tomas Gustavsson | 8 Dec 14:17
Picon

patch for single sign-on using SSL client certificates


Hi, we are using SSL with client certificate authentication to all our 
web-pages. Naturally using this one would like to authenticate the users with 
the certificate instead of username/password. So I hacked up a small patch to 
snipsnap that will grab the username from the authenticated certificate and use 
that. The user still has to be registered as a snipsnap user off-course, but 
he/she is automagically logged in when going to snipsnap.

The essence of my patch in DefaultSessionService is below.

Is the snipsnap authors/community interested in such a patch in the real 
snipsnap distribution?

Cheers,
Tomas

     /**
    * Get user from session or cookie.
    */
   public User getUser(HttpServletRequest request, HttpServletResponse response) {
     HttpSession session = request.getSession();
     User user = (User) session.getAttribute(ATT_USER);
     String appOid = (String)Application.get().getObject(Application.OID);
     if (null != user && !appOid.equals(user.getApplication())) {
       user = null;
     }
     if (user == null) {
	    // Part for authenticating users with X509Certificates. If the user have a 
trusted client certificate
	    // he can get access to the server. Since the certificate is trusted 
(Continue reading)

Matthias L. Jugel | 8 Dec 14:36
Picon
Favicon

Re: patch for single sign-on using SSL client certificates

Hi,

this is great. I will patch it in as soon as I find the time to.  
Adding Basic Auth would probably be a good idea too.

Leo.

On 08.12.2005, at 14:17, Tomas Gustavsson wrote:

>
> Hi, we are using SSL with client certificate authentication to all  
> our web-pages. Naturally using this one would like to authenticate  
> the users with the certificate instead of username/password. So I  
> hacked up a small patch to snipsnap that will grab the username  
> from the authenticated certificate and use that. The user still has  
> to be registered as a snipsnap user off-course, but he/she is  
> automagically logged in when going to snipsnap.
>
> The essence of my patch in DefaultSessionService is below.
>
> Is the snipsnap authors/community interested in such a patch in the  
> real snipsnap distribution?
>
> Cheers,
> Tomas
>
>     /**
>    * Get user from session or cookie.
>    */
>   public User getUser(HttpServletRequest request,  
(Continue reading)


Gmane