Jira (PUP-5622) Enable use of client certificate dNSName for client authentication

[Ahti Seier (JIRA)]

Title: Message Title

Ahti Seier updated an issue   Puppet / PUP-5622 Enable use of client certificate dNSName for client authentication Change By: Ahti Seier Since puppet is allowing the use of external CA-s to authenticate clients it would be nice if client authentication would take into account subjectAlternativeName: dNSName field.  I ran into this in our environment where we have a AD CA that can autoenroll certificates to servers that are authenticated by AD using kerberos. The CN is set to the kerberos principal name but SAN:dNSName is set to hosts dns name. Puppet runs under redhat satellite 6 (katello), through httpd.  I implemented this locally like this:  ?? {code} --- network/http/rack/rest.rb     2015-12-17 10:10:41.227905960 +0200 +++ network/http/rack/rest.rb.mod 2015-12-17 10:11:51.425907634 +0200 @@ -100,6 +98,27 @@      end    end +  def cert_dns_name(request) +    cert = request.env['SSL_CLIENT_CERT'] +    if cert.nil? || cert.empty? +      nil +    else +      ossl_cert = OpenSSL::X509::Certificate.new(cert) +      ossl_cert.extensions.each do |ext| +        next if ext.oid != "subjectAltName" +        san = OpenSSL::ASN1.decode(ext.to_der).value.last +        alt_names = OpenSSL::ASN1.decode(san.value) +        alt_names.value.each do |san| +     # 2 is dNSName (RFC3280), only use first +          next if san.tag != 2 +          return san.value +        end +        break +      end +      nil +    end +  end +    # Passenger freaks out if we finish handling the request without reading any    # part of the body, so make sure we have.    def cleanup(request) @@ -117,7 +136,10 @@      subj_str = request.env[Puppet[:ssl_client_header]]      subject = Puppet::Util::SSL.subject_from_dn(subj_str || "") -    if cn = Puppet::Util::SSL.cn_from_subject(subject) +    if dns_name = cert_dns_name(request) +      result[:node] = dns_name +      result[:authenticated] = (request.env[Puppet[:ssl_client_verify_header]] == 'SUCCESS') +    elsif cn = Puppet::Util::SSL.cn_from_subject(subject)        result[:node] = cn        result[:authenticated] = (request.env[Puppet[:ssl_client_verify_header]] == 'SUCCESS')      else ?? {code} Add Comment   This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.