Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Apache server that serves up mercurial repositories and it currently authenticates using ldap credentials.

I want to permit a single user (to start with) to use a SSL client certificate, with all remaining users still able to use the ldap credentials authentication method.

I have looked through Stack Overflow and other wider (google) searches but can not find information/guidance on how to set this up.

The following vhost config only allow the client cert through. I comment out the three statemens related to SSL-client; ladp will work.

<VirtualHost hg.mydomain.com:80>

    ServerName hg.mydomain.com:80
    RedirectMatch permanent ^(.*)$ https://hg.mydomain.com$1

</VirtualHost>

<VirtualHost hg.mydomain.com:443>

        ServerName hg.mydomain.com:443
        # ServerAdmin webmaster@yourdomain.com
        DocumentRoot "/var/hg"
        CustomLog /var/log/httpd/hg-access.log combined
        ErrorLog /var/log/httpd/hg-error.log

        ScriptAliasMatch        ^/(.*)        /var/hg/hgweb.cgi$1
  # SSL Stuff...
        SSLEngine on
        SSLCipherSuite AES+HIGH:3DES+HIGH:RC4:!MD5:!EXPORT:!SSLv2:!aNULL:!eNULL:!KRB5

        # Server Certificate:
        SSLCertificateFile ssl/hg.mydomain.com.crt
        # Server Private Key:
        SSLCertificateKeyFile ssl/hg.mydomain.com.key
        # SSL Protocol Adjustments:
        BrowserMatch ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

  <Directory /var/hg>
    Options ExecCGI FollowSymlinks
    AddHandler cgi-script .cgi

    AllowOverride AuthConfig
         Order deny,allow
        Allow from all

    #SSL-Client Statements
         SSLVerifyClient optional
         SSLVerifyDepth  1
         SSLRequire   %{SSL_CLIENT_S_DN_CN}  eq "robotuser"

     AuthName "Developers"
         AuthBasicProvider ldap
         # AuthLDAPEnabled On
         AuthLDAPUrl ldaps://ldap.applied.sec/dc=applied,dc=sec?uid
        AuthzLDAPAuthoritative On
        Require valid-user
  </Directory>

    # Taken from http://www.pmwiki.org/wiki/Cookbook/CleanUrls#samedir
    # Used at http://ggap.sf.net/hg/
    RewriteEngine On
    #write base depending on where the base url lives
    #RewriteBase /hg
    RewriteRule ^$ hgweb.cgi  [L]
    # Send requests for files that exist to those files.
    RewriteCond %{REQUEST_FILENAME} !-f
    # Send requests for directories that exist to those directories.
    RewriteCond %{REQUEST_FILENAME} !-d
    # Send requests to hgweb.cgi, appending the rest of url.
    RewriteRule (.*) /hgweb.cgi/$1  [QSA,L]

    Include repos.d/repos.*.conf


It seems like I need to somehow create an alias for the directory block and then apply logic to check for the presence/absence of the client certificate. I do not know how to do that.

If there are other ways to accimplish this. I would love the hear about it.

share|improve this question
add comment

migrated from stackoverflow.com Oct 25 '12 at 16:22

This question came from our site for professional and enthusiast programmers.

2 Answers

This is somewhat of a guess (I don't have any easy way to try this) but perhaps some combination of SSLOptions +FakeBasicAuth and Satisfy Any will see you through?

share|improve this answer
add comment

You would have to do that type of logic on a backend server, either PHP or Java or Perl. Then redirect by setting the header Location: to the actual source control.

If you want an if/then/else type logic, you have to implement that in a programming language.

I'm not sure what you mean by your statement. You said this config only allows the client cert through, and you also said LDAP will work. That makes it sound like you have everything working and you are all set!

I would change to . Directory is usually for file system specific things though they are kind of similar.

Try using two different and to allow the user to pick the URL based on the authentication they want to try.

SSLVerifyClient optional will just allow the client to present a cert, if they feel like it. You might have to change to require. The authentication will occur at the Apache level, and if they fail, they will get an server error.

https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslverifyclient

Put the LDAP into another and the user can go there instead. I've not used LDAP authentication module from Apache.

You could modify the error file to include a link or automatic redirect to the LDAP link if they fail the SSL link.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.