5

OK I have spent all day on this--

I'm using apache with mod_ssl I'm trying to take an existing environment header, "%{SSL_CLIENT_S_DN_CN}s" which looks like "Lastname Firstname Mi username" and set a new header called USERNAME and set that equal to just username (the characters between the last space and the end of the string)

I would then reverse proxy that header to a backend host which would use it to identify the user.

I have tried a lot of different things. I don't know if the problem is that I don't understand perl regex or if I don't understand the syntax or I'm not putting it in the right place, or all three.

Here is an example of one thing I tried:

SetEnvIf SSL_CLIENT_S_DN_CN (.*\ )(.*) newhostname=$2
RequestHeader set HOSTNAME "%{newhostname}e"

All I really want is a new header Hostname to equal the last non-whitespace characters in the DN_CN environment variable.

3 Answers 3

3

Ok -- I figured it out middle of the week but still wanted to give someone a chance to earn the bounty.

Surprisingly, this isn't very well documented anywhere, but as I used mod_headers to do this you can find that documentation here.

What you want to do it set the header, whether you grab it from ssl or the environment. Then you can edit the header in place using regex and capture groups.

Some examples:


  RequestHeader set REMOTE_USER        "%{SSL_CLIENT_S_DN_CN}s"
  RequestHeader edit REMOTE_USER (.*\s)(.*) $2
  RequestHeader set AUTHENTICATE_CN    "%{SSL_CLIENT_S_DN_CN}s"
  RequestHeader edit AUTHENTICATE_CN (.*\s)(.*) $1
  RequestHeader set AUTHENTICATE_MAIL  "%{SSL_CLIENT_S_DN_CN}s"
  RequestHeader edit AUTHENTICATE_MAIL (.*\s)(.*) [email protected] 

2
  • 2
    O_O you bet it's not "well documented", i spend 1h reading the page before getting here, to finally find the %{XX}s syntax !!!
    – 131
    Jul 17, 2014 at 16:55
  • Yeah it was pretty tough to sort this one out. I tried probably a dozen things first. I think though that as mutual auth becomes more prolific, mutating the headers may become more commonplace. Thanks for the upvote!
    – MattPark
    Jul 17, 2014 at 20:38
1

I'd use the AuthBasicFake directive which will set the header and then you can do the ProxyPass in the same Location block. It would look something like this:
<Location "/blah">
AuthBasicFake %{SSL_CLIENT_S_DN_CN}
ProxyPass http://example.org/blah
</Location>

If you have some other x509 attributes in the subject like the username on its own you could use SSL_CLIENT_S_DN_uid or SSL_CLIENT_S_DN_email.

2
  • I'm specifically trying to pare down to the uid which is part of the dn_cn. It's not its own x509 attribute otherwise this would be easy. The username is always the last word in the cn.
    – MattPark
    Aug 13, 2013 at 13:24
  • I've had a look and I'm not sure it's possible without an addon module with either AuthBasicFake or <If>/SetEnvIf. Both of these directives use the syntax of the Apache expr language where you want the form variable ::= "%{" varname "}" | "%{" funcname ":" funcargs "}" but there are no functions which are applicable. The only thing that might work is mod_rewrite. Aug 19, 2013 at 0:35
0

Never done this with SSL (and I don't really understand it here), but mod_security could be an answer. It can rewrite/add/replace/patch anything inside of decrypted content.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .