> -----Original Message----- > From: Nick Kew > Sent: Donnerstag, 9. September 2010 01:01 > To: [email protected] > Subject: Fake Basic Authentication > > Someone asked on IRC today about seemlessly mixing SSL Client > authentication (FakeBasicAuth) with normal basic authn. > As I understood it, users without a client cert should authenticate, > but those with one would be spared the authn dialogue.
You confuse me. Doesn't this already work with Basic Auth if the user that presents the certificate is registered in the Authn provider with the password 'password'? Of course this also means that if someone knows the username in the certificate of one of the users he can log in WITHOUT certificate using the username and 'password' (provided that client certs are not mandatory of course). Maybe it would be helpful to post an example configuration snippet to be sure that we are really talking about the same thing. > > A quick look at mod_ssl reveals that FakeBasicAuth sets r->user > in an Access hook, so it's set before authn. So what the user In the case that FakeBasicAuth is turned on r->user is not set by mod_ssl. In this case it only adds a fake Basic auth header to r->headers_in in ssl_hook_UserCheck (which is the same hook that mod_auth_basic runs in but earlier) and leaves the job of setting r->user to mod_auth_basic. Regards Rüdiger
