On Mon, Sep 11, 2006 at 10:44:18AM +0200, Jean-Gerard Pailloncy wrote:
> Le 11 sept. 06 à 05:57, Michael Fuhr a écrit :
> > If such a capability existed then it could arguably be considered
> > a flaw in SSL because it would allow a server to impersonate one
> > of its clients to another server or to hijack a client's secure
> > connection with another server. Secure protocols are designed to
> > prevent such attacks.
>
> The point is to USE AGAIN the authentification done by Apache with
> PostgreSQL not DO AGAIN the authentification.
To "use again" the client's authentication you'd have to "do again"
the authentication. If the PHP script makes an SSL connection to
PostgreSQL then that connection is independent of the HTTP client's
SSL connection with the web server. If the server in the new
connection (PostgreSQL) sends an SSL CertificateRequest message
then the client (the PHP script) needs access to a certificate and
the corresponding private key to reply with Certificate and
CertificateVerify messages. The HTTP client's certificate would
be available but that client's private key would not, so the PHP
script would have no way to build a valid CertificateVerify message.
> Googling around, I found:
> mod_auth_krb with "AuthType KerberosV5SaveCredentials"
> The auth is done by mod_auth_krb and mod_perl is able to use the same
> ticket for PostgreSQL. It is in the doc of PG.
You didn't mention Kerberos before; you said you wanted to reuse
the client's SSL authentication. Kerberos works differently than
SSL; I'd have to research the links you mentioned to see if reusing
the client's credientials would indeed be possible using Kerberos.
--
Michael Fuhr
