<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<meta name="Generator" content="Zarafa WebApp v7.0.8-35178">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>AW: [Owncloud] oc with ssl client certificate</title>
</head>
<body>
<p>Hi Johannes,<br>I haven't tried it by myself but theoratically when using a client certificate the apache webserver adds <code class="plain plain">SSL_SERVER_I_DN_CN</code><code class="plain plain"> and SSL_SERVER_I_DN_Email to the $_SERVER array.<br></code></p><p>This makes it very easy to add a check if a certificate is available in index.php.</p><p>if(!isset($_SERVER['SSL_SERVER_I_DN_CN'])) {</p><p> die('You must provide a valid client certificate!');<br>}</p><p>When anybody opens your owncloud without a certificate he will receive a blank page which tells "You must provide a valid client certificate".<br>If the browser send this certificate the login should appear as usual.</p><p>Hope this helps as workaround.</p><p>Regards<br>Mario<br></p><blockquote style="border-left: 2px solid #325FBA; padding-left: 5px; margin-left: 5px; margin-right: 0px;">-----Ursprüngliche Nachricht-----<br><strong>Von:</strong> Dr. Johannes Zellner <johannes@zellner.org><br><strong>Gesendet:</strong> Mit 30 Oktober 2013 22:49<br><strong>An:</strong> owncloud@kde.org<br><strong>Betreff:</strong> Re: [Owncloud] oc with ssl client certificate<br><br><base target="_blank">
<!-- begin sanitized html -->
<div dir="ltr">Hi,<div><br></div><div>thanks.</div><div><br></div><div><span style="font-family:arial,sans-serif;font-size:13px"><i>The interesting question from my (the client) perspective is: (how) did you make it work on the server?</i></span><br>
</div><div><span style="font-family:arial,sans-serif;font-size:13px"><i><br></i></span></div><div>It's as simple as having the client certificate to grant (and be required) to access the web server.</div><div>Afterwards I've to log into owncloud as usual.</div>
<div><br></div><div>So this is a two stage login process, which...</div><div><br></div><div>1. ...prevents anybody who doesn't have a valid client certificat to even see the login page</div><div>2. ...still allows to log into owncloud under different accounts, e.g. an admin and a user account (if you have the certificate)</div>
<div><br></div><div>This is perfectly what I like and what works inside a web browser.</div><div>In fact I wouldn't like the certificate to be linked to an owncloud account as it wouldn't allow me to log in under different accounts any more.</div>
<div>I believe that this is a very common scenario that someone wishes to double-protect a private owncloud server.</div><div><br></div><div>so it would be nice to have client authentication working with the owncloud clients.</div>
<div><br></div><div>regards,</div><div class="gmail_extra"><br clear="all"><div>-- <br>Johannes</div>
<br><br><div class="gmail_quote">2013/10/30 Daniel Molkentin <span dir="ltr"><<a href="mailto:danimo@owncloud.com" onclick="parent.webclient.openWindow(this, 'createmail', 'index.php?load=dialog&task=createmail_standard&to=danimo@owncloud.com'); return false;" target="_blank" title="Der externe Link wird in einem neuen Fenster geöffnet">danimo@owncloud.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">Hi Johannes,<div><br><div><div>Am 30.10.2013 um 17:03 schrieb Dr. Johannes Zellner:</div><div class="im"><br><blockquote type="cite"><div dir="ltr">how do owncloud clients work when apache is configured with ssl client certificate authentification?</div>
</blockquote><div><br></div></div><div>Neither the desktop nor the mobile clients support certificate authentication at this point, see below for details.</div><div class="im"><br><blockquote type="cite"><div dir="ltr"><div>
does the windows client work with a client certificate?</div></div></blockquote><div><br></div></div><div>The Desktop Client (which has the same codebase for all OSes), has <a href="https://github.com/owncloud/mirall/issues/69" target="_blank" title="Der externe Link wird in einem neuen Fenster geöffnet">https://github.com/owncloud/mirall/issues/69</a> filed for that. It's not yet scheduled for any release, but if you look at the bug report, someone has volunteered to look into it, although it's been a few weeks since I last heard of him.</div>
<div><br></div><div>The interesting question from my (the client) perspective is: (how) did you make it work on the server? IMHO client certificates are only interesting if ownCloud automatically maps them to a user (as opposed to just being in front of http basic auth as a second layer), and afaik there is no user backend for the server that implements such functionality.</div>
<div class="im"><div><br></div><blockquote type="cite"><div dir="ltr"><div>does mounting via davfs2 on linux work with a client certificate?</div>
</div></blockquote><br></div></div><div>Haven't tested that yet myself. The man page indicates that it does. </div><div><br></div><div>Cheers,</div><div> Daniel</div><br><div>
<span style="text-indent:0px;letter-spacing:normal;font-variant:normal;text-align:-webkit-auto;font-style:normal;font-weight:normal;line-height:normal;border-collapse:separate;text-transform:none;font-size:medium;white-space:normal;font-family:Helvetica;word-spacing:0px"><span style="text-indent:0px;letter-spacing:normal;font-variant:normal;text-align:-webkit-auto;font-style:normal;font-weight:normal;line-height:normal;border-collapse:separate;text-transform:none;font-size:medium;white-space:normal;font-family:Helvetica;word-spacing:0px"><div style="word-wrap:break-word">
<span style="text-indent:0px;letter-spacing:normal;font-variant:normal;text-align:-webkit-auto;font-style:normal;font-weight:normal;line-height:normal;border-collapse:separate;text-transform:none;font-size:medium;white-space:normal;font-family:Helvetica;word-spacing:0px"><div style="word-wrap:break-word">
<div>--</div><div><a href="http://www.owncloud.com" target="_blank" title="Der externe Link wird in einem neuen Fenster geöffnet">www.owncloud.com</a> - Your Data, Your Cloud, Your Way!</div><div><br>ownCloud GmbH, GF: Markus Rex, Holger Dyroff<br>Schloßäckerstrasse 26a, 90443 Nürnberg, HRB 28050 (AG Nürnberg)</div>
</div></span></div></span></span>
</div>
<br></div></div><br>_______________________________________________<br>
Owncloud mailing list<br>
<a href="mailto:Owncloud@kde.org" onclick="parent.webclient.openWindow(this, 'createmail', 'index.php?load=dialog&task=createmail_standard&to=Owncloud@kde.org'); return false;" target="_blank" title="Der externe Link wird in einem neuen Fenster geöffnet">Owncloud@kde.org</a><br>
<a href="https://mail.kde.org/mailman/listinfo/owncloud" target="_blank" title="Der externe Link wird in einem neuen Fenster geöffnet">https://mail.kde.org/mailman/listinfo/owncloud</a><br>
<br></blockquote></div><br></div></div>
<pre>_______________________________________________<br>
Owncloud mailing list<br>
Owncloud@kde.org<br>
https://mail.kde.org/mailman/listinfo/owncloud<br>
</pre>
<!-- end sanitized html -->
</blockquote>
</body>
</html>