evolix
/
wiki
22
0
Fork 0
Code Releases Activity

Add more example to SSLauth

This commit is contained in:
vlaborie 2017-05-13 22:50:49 +02:00
parent 6de040cebd
commit 06e8e9ca5e
1 changed files with 44 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
HowtoSSLauth.md
View File

@ -24,15 +24,41 @@ OpenSSL 1.0.2h 3 May 2016
~~~ ~~~
SSLCACertificateFile /etc/ssl/certs/CA.pem SSLCACertificateFile /etc/ssl/certs/CA.pem
SSLVerifyDepth 1 SSLVerifyClient optional
SSLVerifyClient require #SSLVerifyClient require
SSLOptions +FakeBasicAuth
~~~ ~~~
### Nginx ### Nginx
/etc/nginx/sites-enabled/vhostname
~~~ ~~~
ssl_client_certificate /etc/ssl/certs/CA.pem; ssl_client_certificate /etc/ssl/certs/CA.pem;
ssl_verify_client require; ssl_verify_client optional;
#ssl_verify_client on;
~~~
/etc/nginx/conf.d/ssl-client.conf
~~~
map $ssl_client_s_dn $ssl_client_s_cn
{
default "";
~/CN=(?<CN>[^/]+) $CN;
}
~~~
Authentification via proxy :
~~~
proxy_set_header X-Authenticated-User $ssl_client_s_cn;
~~~
Authentification via fastcgi :
~~~
fastcgi_param REMOTE_USER $ssl_client_s_cn;
~~~ ~~~
### Dovecot ### Dovecot
@ -66,6 +92,21 @@ passdb {
jdoe:{plain}::::::nopassword jdoe:{plain}::::::nopassword
~~~ ~~~
## Coté application web
### Gogs / Gitea
app.ini
~~~
[security]
REVERSE_PROXY_AUTHENTICATION_USER = X-Authenticated-User
[service]
ENABLE_REVERSE_PROXY_AUTHENTICATION = true
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = false
~~~
## Coté client ## Coté client
### Curl ### Curl