mod_ssl: Allow the SSLUserName to be used to control the username passed

by the FakeBasicAuth option. PR52616.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1432322 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/log-message-tags/next-number b/docs/log-message-tags/next-number
index 51d5790fa9f868a85be0248272549f414760a4e1..ad9c93152370a53c8f4a8586ae49d251283ac7c0 100644 (file)
--- a/docs/log-message-tags/next-number
+++ b/docs/log-message-tags/next-number
@@ -1 +1 @@
-2434
+2435

diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml
index 9697b26ee83382864ca473ecbda595687334b8dc..91b8be3d41e3759f8127a53a1111bae7c8cd736b 100644 (file)
--- a/docs/manual/mod/mod_ssl.xml
+++ b/docs/manual/mod/mod_ssl.xml
@@ -1282,12 +1282,15 @@ The available <em>option</em>s are:</p>
     be used for access control. The user name is just the Subject of the
     Client's X509 Certificate (can be determined by running OpenSSL's
     <code>openssl x509</code> command: <code>openssl x509 -noout -subject -in
-    </code><em>certificate</em><code>.crt</code>). Note that no password is
-    obtained from the user. Every entry in the user file needs this password:
-    ``<code>xxj31ZMTZzkVA</code>'', which is the DES-encrypted version of the
-    word `<code>password</code>''. Those who live under MD5-based encryption
-    (for instance under FreeBSD or BSD/OS, etc.) should use the following MD5
-    hash of the same word: ``<code>$1$OXLyS...$Owx8s2/m9/gfkcRVXzgoE/</code>''.</p>
+    </code><em>certificate</em><code>.crt</code>). The optional <directive
+    module="mod_ssl">SSLUserName</directive> directive can be used to
+    specify which part of the certificate Subject is embedded in the username.
+    Note that no password is obtained from the user. Every entry in the user
+    file needs this password: ``<code>xxj31ZMTZzkVA</code>'', which is the
+    DES-encrypted version of the word `<code>password</code>''. Those who
+    live under MD5-based encryption (for instance under FreeBSD or BSD/OS,
+    etc.) should use the following MD5 hash of the same word:
+     ``<code>$1$OXLyS...$Owx8s2/m9/gfkcRVXzgoE/</code>''.</p>
 </li>
 <li><code>StrictRequire</code>
     <p>
@@ -2039,9 +2042,9 @@ string. In particular, this may cause the environment variable
 <code>REMOTE_USER</code> to be set.  The <em>varname</em> can be
 any of the <a href="#envvars">SSL environment variables</a>.</p>
 
-<p>Note that this directive has no effect if the
-<code>FakeBasicAuth</code> option is used (see <a
-href="#ssloptions">SSLOptions</a>).</p>
+<p>When the <code>FakeBasicAuth</code> option is enabled, this directive
+instead controls the value of the username embedded within the basic
+authentication header (see <a href="#ssloptions">SSLOptions</a>).</p>
 
 <example><title>Example</title>
 <highlight language="config">

diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
index 1b69d4c01334a89f3ccc2686f97a02439a2dc3f3..7d26038bbdcbc376d048be38e57c33e22a182b2f 100644 (file)
--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
@@ -957,7 +957,7 @@ int ssl_hook_UserCheck(request_rec *r)
     SSLConnRec *sslconn = myConnConfig(r->connection);
     SSLSrvConfigRec *sc = mySrvConfig(r->server);
     SSLDirConfigRec *dc = myDirConfig(r);
-    char *clientdn;
+    char *user;
     const char *auth_line, *username, *password;
 
     /*
@@ -1023,7 +1023,19 @@ int ssl_hook_UserCheck(request_rec *r)
         OPENSSL_free(cp);
     }
 
-    clientdn = (char *)sslconn->client_dn;
+    /* use SSLUserName if defined, otherwise use the full client DN */
+    if (dc->szUserName) {
+        user = ssl_var_lookup(r->pool, r->server, r->connection,
+                                   r, (char *)dc->szUserName);
+        if (!user || !user[0]) {
+            ap_log_rerror(
+                    APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(02434) "Failed to set FakeBasicAuth username to '%s', did not exist in certificate", dc->szUserName);
+            return DECLINED;
+        }
+    }
+    else {
+        user = (char *)sslconn->client_dn;
+    }
 
     /*
      * Fake a password - which one would be immaterial, as, it seems, an empty
@@ -1038,7 +1050,7 @@ int ssl_hook_UserCheck(request_rec *r)
      */
     auth_line = apr_pstrcat(r->pool, "Basic ",
                             ap_pbase64encode(r->pool,
-                                             apr_pstrcat(r->pool, clientdn,
+                                             apr_pstrcat(r->pool, user,
                                                          ":password", NULL)),
                             NULL);
     apr_table_setn(r->headers_in, "Authorization", auth_line);