Hi I have been trying to find a way to get x509 certs for authentication for Trac but I could not find any plugins on TracHacks or tutorials on this.

The closest I've seen so far is this post on google groups


Does anyone have any idea where I can find relevant information or know how I can go about doing this?



Trac (vainilla) delegates its authentication to the apache (or other server software) and the authorization to trac. So the best way to do what are you trying to, is to issue some certificates to server and users, and setup apache for using it using FakeBasicAuth apache mod_ssl directive.

and configure a VirtualHost:

    SSLEngine on
    SSLProtocol all
    SSLCipherSuite HIGH:MEDIUM

    SSLCertificateFile /path/to/server.crt
    SSLCertificateKeyFile /path/to/server.key
    SSLCACertificateFile /path/to/ca.crt
    SSLCARevocationPath /path/to/crl

    SetEnvIf User-Agent ".*MSIE.*" \
           nokeepalive ssl-unclean-shutdown \
           downgrade-1.0 force-response-1.0

    SSLVerifyClient optional
    SSLVerifyDepth 1

    <Directory /path/to/project/>
        SetHandler mod_python
        PythonHandler trac.web.modpython_frontend
        PythonOption TracEnvParentDir /path/to/
        PythonOption TracUriRoot /
        SetEnv PYTHON_EGG_CACHE /var/cache/python-eggs
        SSLOptions +StdEnvVars
        SSLOptions +FakeBasicAuth
        AuthName trac
        AuthType Basic
        AuthUserFile /path/to/passwd
        Require valid-user

Then you will need a htpasswd file containing the DN of the certificate as user and the hash xxj31ZMTZzkVA as password.

You can share the authentication Scheme with Subversion over https and then the user names will match with the commiters

There's also a problem with user names. I solved it patching the trac code itself using something similar to this patch

I'm also using the users mail as "CN" so without configuring, trac knows where to send ticket mails.

All of this for trac 0.11 and 0.10 I haven't upgraded trac yet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.