Vanni Galesso <[EMAIL PROTECTED]> writes:
>I want to write a cgi application that runs on a Secure Web Server that
>request a client certificate.
>I mean , when a browser runs this cgi , a client authentication request
>will generated .
>The browser will sent the client certificate and the cgi will process
>this authentication with some operations .
When the client asks the server to run the cgi, client auth can be enabled by
referring to the cgi on an https port for which the server requires client
authentication. Additionally, if the cgi is in a subdir protected by a
.htaccess file, then it can only be executed after a successful client auth
by the server for users in the .htpasswd file specified by the .htaccess.
I do this on a server running "Apache/1.2.6 Ben-SSL/1.14" using SSLFakeBasicAuth.
Although the cgi is not performing the initial authentication, it can access
the SSL_CLIENT_DN environment variable passed in from the server and do
additional checks on that if needed.
...Rick [EMAIL PROTECTED], http://www.ece.vill.edu/~perry [PGP]
+-------------------------------------------------------------------------+
| Administrative requests should be sent to [EMAIL PROTECTED] |
| List service provided by Open Software Associates, http://www.osa.com/ |
+-------------------------------------------------------------------------+
