使用Nginx和Tomcat Web应用程序进行TLS客户端身份验证

Question

I have a Tomcat 8 web application, it runs on the port 8080 on the server. Any incoming request to port 443 is forwarded to localhost:8080 using Nginx to serve the web application.

I am trying to set up mutual authentication & then parse the client cert that was used for the authentication by the application. This information will then be used by the application to decide if the user should have admin or user rights. The client cert will bear the string admin or user in the Common Name (CN) field.

I am able to achieve the mutual authentication & below is the current nginx ssl.conf But the problem is that the cert info is not passed to the tomcat web application to parse the data. Is there a way available in nginx to pass on the client cert data, so the tomcat8 application can use that?

server {
    listen       443 default_server;
    server_name  name.domain.com;

    ssl on;
    ssl_certificate /etc/nginx/self-signed.pem;
    ssl_certificate_key /etc/nginx/self-signed.pem;
    ssl_protocols SSLv2 TLSv1 TLSv1.1 TLSv1.2;


    ssl_client_certificate /etc/nginx/ca.cert.pem;
    ssl_verify_client optional;
    ssl_verify_depth  2;
    ssl_session_timeout  5m;
    ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
    ssl_prefer_server_ciphers  on;


    port_in_redirect off;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    #test page for the load balancer
    location /loadbalancer {
      add_header X-Frame-Options "DENY";
      auth_basic off;
      #proxy_pass http://localhost:8080;
      try_files $uri /test.html;
    }

    location /webapi {
      add_header X-Frame-Options "DENY";
      auth_basic off;
      proxy_pass http://localhost:8080;
    }

    location / {
      if ($ssl_client_verify != SUCCESS)

     {
      return 403;
      break;
     }

      add_header X-Frame-Options "DENY";
      proxy_pass http://localhost:8080;
    }


    error_page  404              /404.html;
      location = /404.html {
      root   /usr/share/nginx/html;
    }

    error_page   500 502 503 504  /50x.html;
      location = /50x.html {
      root   /usr/share/nginx/html;
    }
}

Answer 1

You can use the proxy_set_header directive to pass additional headers to your tomcat.

Available variables

http://nginx.org/en/docs/http/ngx_http_ssl_module.html#var_ssl_cipher

Example

proxy_set_header SSL_DN $ssl_client_s_dn;

In your Java app you can read this headers for further processing.

On a side note I would not save the access level in the certificate but in a server side database, that way you could reassign / change / add roles easier or revoke a valid certificate.

EDIT Actually nginx supports certificate revocation lists as well: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_crl

Good article for nginx + php which can be easily adapted into your use case:

http://nategood.com/client-side-certificate-authentication-in-ngi