Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[Security] [Authenticator] X509 authenticator should can use CN as UserIdentifier #47354

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
mpiot opened this issue Aug 22, 2022 · 0 comments · Fixed by #48200
Closed

[Security] [Authenticator] X509 authenticator should can use CN as UserIdentifier #47354

mpiot opened this issue Aug 22, 2022 · 0 comments · Fixed by #48200
Labels
Feature Security

Comments

@mpiot
Copy link
Contributor

mpiot commented Aug 22, 2022 •
edited
Loading

Description

Acutally in the Symfony\Component\Security\Http\Authenticator\X509Authenticator, the userIdentifier is always the emailAdress part of the TLS subject:

Subject: C = FR, O =My Organization, CN = user1, emailAddress = [email protected]

In some case, we do not identify user by their email address and prefer use the CN (Common Name) as identifier, because our users do not have email, or the x509 Client Certificate do not contains email (eg: in case of Caddy server, the emailAddress is not part of the TLS Subject).

Is it better to add a parameter to defined the subject field (eg: CN or emailAddress) we want ? But it can cause trouble in case of Apache, because the userKey (aka: field extract from tls subject) parameter contains the SSL_CLIENT_S_DN_Email fastcgi env (Apache only).

In the case of Caddy or Nginx, the HTTP server only return the SSL_CLIENT_S_DN fastcgi env (do not split the string and extract CN or emailAddress), and the Authenticator try to extract it from the credentialsKey parameter (aka tls subject).

Actual x509 config:

  • userKey: default on SSL_CLIENT_S_DN_Email (Apache) => Email part from the TLS Subject
  • credentialsKey: default on SSL_CLIENT_S_DN (All HTTP server) => TLS Subject

Example

No response
@mpiot mpiot changed the title [Security][Authenticator] X509 authenticator should can use CN as UserIdentifier [Security] [Authenticator] X509 authenticator should can use CN as UserIdentifier Aug 22, 2022
@mpiot mpiot changed the title [Security] [Authenticator] X509 authenticator should can use CN as UserIdentifier [Security] [Authenticator] x509 authenticator should can use CN as UserIdentifier Aug 22, 2022
@mpiot mpiot changed the title [Security] [Authenticator] x509 authenticator should can use CN as UserIdentifier [Security] [Authenticator] X509 authenticator should can use CN as UserIdentifier Aug 22, 2022
@xabbuh xabbuh added the Feature label Aug 22, 2022
@Spomky Spomky mentioned this issue Nov 11, 2022
Merged
@fabpot fabpot closed this as completed Dec 18, 2022
fabpot added a commit that referenced this issue Dec 18, 2022
@fabpot
feature #48200 [Security] Allow custom user identifier for X509 authe…
c6c300c 
…nticator (Spomky)

This PR was squashed before being merged into the 6.3 branch.

Discussion
----------

[Security] Allow custom user identifier for X509 authenticator

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | Fix #47354
| License       | MIT
| Doc PR        | **to be created**

This PR allows defining a custom user identifier instead of the hardcoded `emailAddress`.
It also adds a new option for the firewall configuration:

```yaml
# config/packages/security.yaml
security:
    # ...

    firewalls:
        main:
            # ...
            x509:
                provider: your_user_provider
                user_identifier: CN # default to emailAddress
```

**💬 Discussion**: user identifier regex changed
Note that the regex is changed. The previous one was able to find an email address as expected, but now that the common name may not contain a `@` (or may contain more than one), it is required to update this part.
It does not impact the previously merged PR #33759, but I prefer highlight the fact that it can now catch invalid email addresses set in `emailAddress`.

Commits
-------

6479653 [Security] Allow custom user identifier for X509 authenticator
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Feature Security
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Security] Allow custom user identifier for X509 authenticator Spomky/symfony
4 participants
@fabpot @xabbuh @mpiot @carsonbot