Thank you very much, I will take a look at it and tell you if I succeed.
Daniel, > Hi, > > you need a lookup table to map the certificates to roles, usually you > use a connector for this. Have a look at the documentation of the > Handler module (OpenXPKI;:Server::Authentication::X509) - there are some > config snippets and hints. > > Oliver > > Am 20.05.19 um 17:03 schrieb daniel.Jackson.fr via OpenXPKI-users: > > > Thank you, some of these parameters were missing in my Apache configuration. > > I have an other question related to this: is there a way to distinguish the > > users using the certificate he uses ? > > For the moment all certificate users have the same default role. I would > > like all the users to use a certificate, but some of them with more > > privileges. > > How can I adapt the handler to have a different role for some certificates. > > Daniel, > > > > > Hi Daniel, > > > you need to set SSLVerify Options AND set the "ExportCertData" option: > > > SSLVerifyClient optional > > > SSLVerifyDepth 3 > > > SSLCACertificateFile /etc/apache2/ssl/root.pem > > > SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire > > > <Directory /usr/lib/cgi-bin> > > > > > > SSLOptions +StdEnvVars > > > > > > > > > </Directory> > > > Oliver > > > Am 17.05.19 um 09:24 schrieb daniel.Jackson.fr via OpenXPKI-users: > > > > > > > Hi everyone, > > > > I have configured the apache server to force the user to use HTTPS > > > > instead of HTTP. I am working on my own PC (localhost) so i add in > > > > /etc/hosts: > > > > 127.0.0.1 openxpki.com > > > > So with my apache configuration, when I type openxpki.com (I am > > > > redirected to localhost/openpki). > > > > The user also need to have a certificate delivered by the right CA to > > > > access to the OpenXPKI webui. (Apache2 conf). > > > > However, I also wanted to use the authentification by certificate > > > > present in the default settings, but everytime I try to use it, the > > > > webui says: > > > > """ > > > > Required information is missing! > > > > Your web browser failed to present the required information to log in > > > > using the chosen login method. > > > > Please select a different type of authentication. Go back to login page. > > > > """ > > > > I got this on the webui log file : > > > > 2019/05/17 09:32:09 check for cgi session, fcgi pid 22209 > > > > [pid=22209|sid=53d6] > > > > 2019/05/17 09:32:09 session id (front) is > > > > 5774934edc498239ef973eef5a79ad97 [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 Use provided client instance [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 First session reinit with id init > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 New backend session with id cZjG5Wm+Qy+wAMoQ5qiBUw== > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 current session status GET_PKI_REALM > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 Generate rtoken [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 Baseurl from referrer: [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 request handled [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 check for cgi session, fcgi pid 22209 > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 session id (front) is > > > > 5774934edc498239ef973eef5a79ad97 [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 Use provided client instance [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 First session reinit with id > > > > cZjG5Wm+Qy+wAMoQ5qiBUw== [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 Resume backend session with id > > > > cZjG5Wm+Qy+wAMoQ5qiBUw== [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 current session status GET_PKI_REALM > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 not logged in - doing auth - page is login - action > > > > is [pid=22209|sid=5774] > > > > 2019/05/17 09:32:09 request handled [pid=22209|sid=5774] > > > > 2019/05/17 09:32:10 check for cgi session, fcgi pid 22209 > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:10 session id (front) is > > > > 5774934edc498239ef973eef5a79ad97 [pid=22209|sid=5774] > > > > 2019/05/17 09:32:10 Use provided client instance [pid=22209|sid=5774] > > > > 2019/05/17 09:32:10 First session reinit with id > > > > cZjG5Wm+Qy+wAMoQ5qiBUw== [pid=22209|sid=5774] > > > > 2019/05/17 09:32:10 Resume backend session with id > > > > cZjG5Wm+Qy+wAMoQ5qiBUw== [pid=22209|sid=5774] > > > > 2019/05/17 09:32:10 current session status GET_PKI_REALM > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:10 not logged in - doing auth - page is - action is > > > > login!realm [pid=22209|sid=5774] > > > > 2019/05/17 09:32:10 set realm in session: ca-one [pid=22209|sid=5774] > > > > 2019/05/17 09:32:10 Selected realm ca-one, new status > > > > GET_AUTHENTICATION_STACK [pid=22209|sid=5774] > > > > 2019/05/17 09:32:10 request handled [pid=22209|sid=5774] > > > > 2019/05/17 09:32:13 check for cgi session, fcgi pid 22209 > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:13 session id (front) is > > > > 5774934edc498239ef973eef5a79ad97 [pid=22209|sid=5774] > > > > 2019/05/17 09:32:13 Use provided client instance [pid=22209|sid=5774] > > > > 2019/05/17 09:32:13 First session reinit with id > > > > cZjG5Wm+Qy+wAMoQ5qiBUw== [pid=22209|sid=5774] > > > > 2019/05/17 09:32:13 Resume backend session with id > > > > cZjG5Wm+Qy+wAMoQ5qiBUw== [pid=22209|sid=5774] > > > > 2019/05/17 09:32:13 current session status GET_AUTHENTICATION_STACK > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:13 not logged in - doing auth - page is - action is > > > > login!stack [pid=22209|sid=5774] > > > > 2019/05/17 09:32:13 set auth_stack in session: Client Certificate > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:13 Authentication stack: Client Certificate > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:14 Selected realm ca-one, new status > > > > GET_CLIENT_X509_LOGIN [pid=22209|sid=5774] > > > > 2019/05/17 09:32:14 Requested login type CLIENT_X509 > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:14 Certificate missing for X509 Login > > > > [pid=22209|sid=5774] > > > > 2019/05/17 09:32:14 session logout [pid=22209|sid=5774] > > > > 2019/05/17 09:32:14 request handled [pid=22209|sid=5774] > > > > The final idea would be to create a double authentification system: > > > > > > > > - The certificate to identify the user (possess a proof) > > > > - The password to authentificate the user (knows a secret) > > > > > > > > Did i miss something ? The user certificate had been imported in the > > > > browser (Mozilla firefox), and used to access to the webui. I don't > > > > understand why it does not work. > > > > Daniel > > > > OpenXPKI-users mailing list > > > > [email protected] > > > > https://lists.sourceforge.net/lists/listinfo/openxpki-users > > > > > > -- > > > Protect your environment - close windows and adopt a penguin! > > > OpenXPKI-users mailing list > > > [email protected] > > > https://lists.sourceforge.net/lists/listinfo/openxpki-users > > > > OpenXPKI-users mailing list > > [email protected] > > https://lists.sourceforge.net/lists/listinfo/openxpki-users > > -- > > Protect your environment - close windows and adopt a penguin! > > OpenXPKI-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/openxpki-users _______________________________________________ OpenXPKI-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openxpki-users
