SEC-17: X509 integration with Apache mod_proxy about spring-security

[spring-projects-issues]

Scott McCrory said:

Depending upon the vision, I might be able to help address this for Siteminder. See http://forum.springframework.org/viewtopic.php?p=20924&sid=61039a5e2c07493dc47df28f25c9ef57#20924 for a summary and let me know if there’s interest.

[spring-projects-issues]

Ben Alex said:

Moved the SiteMinder integration to a new task http://opensource.atlassian.com/projects/spring/browse/SEC-35 which is assigned to Scott.

[spring-projects-issues]

Ben Alex said:

Hi Luke – would you please update the status of this? If you could expand on the scope of this task it would be good. It might be overlap with SEC-35 so perhaps it should be closed…?

[spring-projects-issues]

Luke Taylor said:

The main thing I was planning on looking at was the integration of X.509 client authentication with apache. This works fine when there is a direct SSL connection to the servlet container – the client certificate can easily be obtained. But I haven’t investigated how well it works with connectors. It’s not really a coding issue though, more just a question of “does it work”, so we can add it to the docs.

It would also be an idea to extend the X.509 provider to obtain the certificate from a request header (assuming the web server has support for setting this up). This would also work using mod_proxy, which is easier to work with. There appear to be some issues at the moment though:

http://issues.apache.org/bugzilla/show_bug.cgi?id=23223

In any case, it wouldn’t hurt to have this functionality in place. It might be better as a separate issue relating to the X.509 provider though.

[spring-projects-issues]

Ben Alex said:

Luke, any chance can we get this sorted out for 1.0.0?

[spring-projects-issues]

Luke Taylor said:

The apache issue still appears to be open and I haven’t had time to do any more work on this.

[spring-projects-issues]

Ben Alex said:

Luke, the cited Apache issue remains open, and given it is now over a year, I am of the view we should close this as “won’t fix”. The task doesn’t appear to have a particular urgency given it’s only applicable to the very specific situation of X509 via an intermediate connector. If someone is trying to do that, they can invest the time to implement it. It’s not a general-purpose or common enough requirement to keep an issue open for when there are more widely-useful enhancements that need addressing as well. Your thoughts?

[spring-projects-issues]

Luke Taylor said:

Ok. :)