证书x509 Laravel身份验证SSL

Question

I'm trying to implement a digital signature to log in in a web with Laravel(php) and I can't find good information.

I think I should use x509 SSL but I can't find nothing. I just found that:

https://github.com/ingria/laravel-x509-auth/wiki/Using-other-cert-attributes

https://github.com/ndavison/laravel-clientcert/blob/master/ClientCertAuthMiddleware.php#L33

But I'm not sure about that. I would appreciate any help.

Answer 1

The short answer:

You need to configure your web server to challenge the client when it connects for a client certificate. That is usually done by specifying your client certificate authority you accept a cert from.

I have written auth controllers in Laravel 5.x before for client tls auth in combination with LDAP, specifically using windows active directory certificate services user certificates. External directory information is still required once they are authenticated to determine group based permissions for example.

Once the web server challenges and accepts a client cert, your application needs to do a bunch of validation, including what attribute are you going to use to uniquely identify user? LDAP distinguished name? User principal name? Non-windows certificate attribute?

Use an X509 cert dumper like openssl -in client.cer -noout -text to look at all the attributes and decide what you need to check and map to a user account in Laravel.

That all said, most people dont just rely on a user cert (although that is super handy for no-interaction-required and very secure authentication) they leverage an external identity provider via something like SAML or OAUTH.

In my case, I use Azure active directory at work and register my apps in the corporate AAD then use a handy laravel service provider like https://github.com/metaclassing/PHP7-Laravel5-EnterpriseAuth which was based on the laravel socialite for azure-ad and some added cert auth goodness.