also match client issuer (CA)

diff --git a/data/schema/6.sql b/data/schema/6.sql
index bc85ffdd28afbdec70c2fecfa2d6b1c55f4b42e6..0c208ad417eca98690be4bdffd92ce418fb20999 100644 (file)
--- a/data/schema/6.sql
+++ b/data/schema/6.sql
@@ -7,6 +7,7 @@ CREATE TABLE `sc_users_sslclientcerts` (
   `id` INT NOT NULL AUTO_INCREMENT ,
   `uId` INT NOT NULL ,
   `sslSerial` VARCHAR( 32 ) NOT NULL ,
+  `sslClientIssuerDn` VARCHAR( 1024 ) NOT NULL ,
   `sslName` VARCHAR( 64 ) NOT NULL ,
   `sslEmail` VARCHAR( 64 ) NOT NULL ,
   PRIMARY KEY ( `id` ) ,

diff --git a/data/tables.sql b/data/tables.sql
index af0c81be77bc442faca7c402e45159a2c30a27af..d53945e60d0c4560dde96d3f53fb41fb3a7900a6 100644 (file)
--- a/data/tables.sql
+++ b/data/tables.sql
@@ -81,6 +81,7 @@ CREATE TABLE `sc_users_sslclientcerts` (
   `id` INT NOT NULL AUTO_INCREMENT ,
   `uId` INT NOT NULL ,
   `sslSerial` VARCHAR( 32 ) NOT NULL ,
+  `sslClientIssuerDn` VARCHAR( 1024 ) NOT NULL ,
   `sslName` VARCHAR( 64 ) NOT NULL ,
   `sslEmail` VARCHAR( 64 ) NOT NULL ,
   PRIMARY KEY ( `id` ) ,

diff --git a/src/SemanticScuttle/Service/User.php b/src/SemanticScuttle/Service/User.php
index 0071f9b34db2f44306f419ede93b5df81338be63..bf7c61d7949097ad64ec2a602b2f4793d9113b7a 100644 (file)
--- a/src/SemanticScuttle/Service/User.php
+++ b/src/SemanticScuttle/Service/User.php
@@ -439,18 +439,26 @@ class SemanticScuttle_Service_User extends SemanticScuttle_DbService
     {
         if (!isset($_SERVER['SSL_CLIENT_M_SERIAL'])
             || !isset($_SERVER['SSL_CLIENT_V_END'])
+            || !isset($_SERVER['SSL_CLIENT_VERIFY'])
+            || $_SERVER['SSL_CLIENT_VERIFY'] !== 'SUCCESS'
+            || !isset($_SERVER['SSL_CLIENT_I_DN'])
         ) {
             return false;
         }
-        //TODO: verify this var is always there
+
         if ($_SERVER['SSL_CLIENT_V_REMAIN'] <= 0) {
             return false;
         }
 
-        $serial = $_SERVER['SSL_CLIENT_M_SERIAL'];
+        $serial         = $_SERVER['SSL_CLIENT_M_SERIAL'];
+        $clientIssuerDn = $_SERVER['SSL_CLIENT_I_DN'];
+
         $query = 'SELECT uId'
             . ' FROM ' . $this->getTableName() . '_sslclientcerts'
-            . ' WHERE sslSerial = \'' . $this->db->sql_escape($serial) . '\'';
+            . ' WHERE sslSerial = \'' . $this->db->sql_escape($serial) . '\''
+            . ' AND sslClientIssuerDn = \''
+            . $this->db->sql_escape($clientIssuerDn)
+            . '\'';
         if (!($dbresult = $this->db->sql_query($query))) {
             message_die(
                 GENERAL_ERROR, 'Could not load user for client certificate',