Trac (vainilla) delegates its authentication to the apache (or other server software) and the authorization to trac. So the best way to do what are you trying to, is to issue some certificates to server and users, and setup apache for using it using FakeBasicAuth
apache mod_ssl directive.
and configure a VirtualHost:
<VirtualHost 127.0.0.1:443>
SSLEngine on
SSLProtocol all
SSLCipherSuite HIGH:MEDIUM
SSLCertificateFile /path/to/server.crt
SSLCertificateKeyFile /path/to/server.key
SSLCACertificateFile /path/to/ca.crt
SSLCARevocationPath /path/to/crl
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
SSLVerifyClient optional
SSLVerifyDepth 1
<Directory /path/to/project/>
SetHandler mod_python
PythonHandler trac.web.modpython_frontend
PythonOption TracEnvParentDir /path/to/
PythonOption TracUriRoot /
SetEnv PYTHON_EGG_CACHE /var/cache/python-eggs
SSLOptions +StdEnvVars
SSLOptions +FakeBasicAuth
AuthName trac
AuthType Basic
AuthUserFile /path/to/passwd
Require valid-user
</Directory>
</VirtualHost>
Then you will need a htpasswd file containing the DN of the certificate as user and the hash xxj31ZMTZzkVA
as password.
You can share the authentication Scheme with Subversion over https and then the user names will match with the commiters
There's also a problem with user names. I solved it patching the trac code itself using something similar to this patch
I'm also using the users mail as "CN" so without configuring, trac knows where to send ticket mails.
All of this for trac 0.11 and 0.10 I haven't upgraded trac yet.