Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to set up an OpenID provider for our group, which we can use to log in to internal and external OpenID-aware services (e.g.

Our users all have X.509 certificates issued by our CA, so I think the ideal solution would use that to authenticate them (i.e. the provider shouldn't ask for a password). Maybe Apache FakeBasicAuth would work to extract the username from the SSL connection's certificate?

What would be the best software to use? Open Source preferred.

share|improve this question
up vote 1 down vote accepted

OK, I got this working using:

In the Apache configuration, I did this (note: didn't use FakeBasicAuth in the end):

SSLCACertificateFile /.../myOrgCA.pem
SSLVerifyClient require
SSLVerifyDepth  1
SSLOptions      +StdEnvVars

Edit action_default() to redirect the user to the https address if accessed over plain http. The plain http address is the one you publish in your <link rel="openid.server">.

Change getLoggedInUser() to extract the username from $_SERVER['SSL_CLIENT_S_DN_Email'].

You can also edit doAuth() to provide the email address or full name in a similar way.

Note sure how secure this all is, but we use it for relatively low-value sites (forums, bug trackers, etc).

share|improve this answer
You could use HTTPS as your openid.server address; some providers like Yahoo and Google do. The potential downside is that HTTPS fetching support on relying parties is remarkably flaky. They don't have the right crypto libs, or they don't have the root CA certs accessible, or they don't have clear policy about what to do with invalid certs... But many RPs do work fine that way (hopefully Yahoo is forcing that number up), and it reduces a potentially vulnerable redirect, so consider it. – keturn Aug 14 '09 at 19:50

I've considered the same thing myself, and the best answer I could find after some research was exactly as you suggested – Apache running mod_ssl, FakeBasicAuth to ID the user, and then extract that to identify the user and validate them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.