issue #2 support ssl offloadin

NIIF · Nov 28, 2016 · ca9d842 · ca9d842
1 parent d09f5b8
commit ca9d842
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 7 deletions.
diff --git a/config-templates/module_aa.php b/config-templates/module_aa.php
@@ -22,4 +22,11 @@
      */
      //'signAssertion' => FALSE,
 
+     /**
+     * Header variable that contain the ssl client certificate, default is SSL_CLIENT_CERT.
+     * Useful when the AA is behind load balancer.
+     */
+     //'sslClientCertContainer' => 'SSL_CLIENT_CERT',
+
+
 );
diff --git a/lib/AA/SAML2.php b/lib/AA/SAML2.php
@@ -1,11 +1,7 @@
 <?php
 
-/*
-Implements SAML2 Attribute Authority
-*/
-
 /**
- *
+ * Implements SAML2 Attribute Authority
  */
 class sspmod_aa_AA_SAML2
 {
@@ -34,6 +30,11 @@ public function __construct($metadata)
             $this->signResponse = $this->config->getBoolean('signResponse');
         }
 
+        $this->sslClientCertContainer = 'SSL_CLIENT_CERT';
+        if ($this->config->hasValue('sslClientCertContainer')) {
+            $this->sslClientCertContainer = $this->config->getString('sslClientCertContainer');
+        }
+
         $this->binding = $this->getBinding();
         $this->query = $this->getQuery();
         $this->attributeNameFormat = $this->getAttributeNameFormat();
@@ -125,9 +126,13 @@ private function authenticate()
         if (array_key_exists('SSL_CLIENT_VERIFY', $_SERVER)) {
             SimpleSAML_Logger::debug('[aa] Request was made using the following certificate: '.var_export($_SERVER['SSL_CLIENT_VERIFY'], 1));
         }
-        if (array_key_exists('SSL_CLIENT_VERIFY', $_SERVER) && $_SERVER['SSL_CLIENT_VERIFY'] && $_SERVER['SSL_CLIENT_VERIFY'] != 'NONE') {
+        if (array_key_exists('SSL_CLIENT_VERIFY', $_SERVER)
+            && $_SERVER['SSL_CLIENT_VERIFY']
+            && $_SERVER['SSL_CLIENT_VERIFY'] != 'NONE'
+            && $_SERVER[$this->sslClientCertContainer]
+            ) {
             /* compare certificate fingerprints */
-            $clientCertData = trim(preg_replace('/--.* CERTIFICATE-+-/', '', $_SERVER['SSL_CLIENT_CERT']));
+            $clientCertData = trim(preg_replace('/--.* CERTIFICATE-+-/', '', $_SERVER[$this->sslClientCertContainer]));
             $clientCertFingerprint = strtolower(sha1(base64_decode($clientCertData)));
             if (!$clientCertFingerprint) {
                 throw new SimpleSAML_Error_Exception('[aa] Can not calculate certificate fingerprint from the request.');