Hi Ivan

Why use radius to check certificates when Apache can do it?

http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html

Thanks for this reply. We need also authorization. So we want to 1.) check if the certificate is signed by a "trusted ca" 2.) check if the username x in the certificate is "known" 3.) check if the user with name x is authorized to access the service. For (2 and) 3 I thought we'd need radius. The authorization could be stored in a database that can be easily modified. Best regards, M.

Martin, If you want to leverage the existing user profiles in the RADIUS server for authentication, authorization, this Internet Draft TLS-EAP Extension http://tools.ietf.org/html/draft-nir-tls-eap-06 might be what you are looking for. Unfortunately, there is no implementation up to date as far as I know. I am designing and developing the software for this Internet draft based on OpenSSL, EAP module from wpa-supplicant and freeradius client. Please let me know any special requirements if you are interested in using TLS-EAP Extension. Thanks, jay On Wed, Jul 1, 2009 at 2:14 PM, Alan DeKok<aland@deployingradius.com> wrote:

Martin Schneider wrote:

...

We need also authorization. So we want to

1.) check if the certificate is signed by a "trusted ca"

 That is done by the normal certificate validation process.

...

2.) check if the username x in the certificate is "known"

 What does that mean?  If the CA signed the certificate, then the usename is known.  Why would the CA sign a certificate for an unknown user?

...

3.) check if the user with name x is authorized to access the service.

 That can be done with RADIUS.

 Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Martin, The Internet Draft address what you described in web client/Apache server and mail client and mail server applications. The TLS-EAp extension is leveraging existing user credential and profile in AAA server. In addition, you have flexibility to choose different authentication method using EAP. You can use token based authentication or client Certificate based authentication. What kind of mail client/mail server and web client/web server are you using? I am recruiting more volunteers for the project and I will keep you posted of my progress. Thanks, jay On Thu, Jul 2, 2009 at 3:16 AM, Martin Schneider<martincschneider@googlemail.com> wrote:

Hello Jay

...

If you want to leverage the existing user profiles in the RADIUS server for authentication, authorization, this Internet Draft TLS-EAP Extension http://tools.ietf.org/html/draft-nir-tls-eap-06 might be what you are looking for. Unfortunately, there is no implementation up to date as far as I know.

I am designing and developing the software for this Internet draft based on OpenSSL, EAP module from wpa-supplicant and freeradius client. Please let me know any special requirements if you are interested in using TLS-EAP Extension.

I read the draft you mentioned above and I'm not 100% sure if I understood it correctly.

So basically spoken the authentication/authorization becomes more of less independant from the application using this software/draft. There's an authentication/authorization infrastructure besides client and service that is generic and can be used for *different* services. So, e.g. I can use it for authentication/authorization for a webbrowser towards apache, for a mailclient towards the mailservice etc.

If it is like that, this sounds pretty amazing and would give us exactely what we need.

Best regards! M - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Martin, You are correct that you need modified TLS library, EAP module and GUI for configuration EAP parameters integrated with each client. It is quite feasible with Firefox. The modified library, EAP module (library) can be made as patch to Firefox and Microsoft IE is another story. Thanks, Jay On Thu, Jul 9, 2009 at 2:56 AM, Martin Schneider<martincschneider@googlemail.com> wrote:

Helllo Jay

...

The Internet Draft address what you described in web client/Apache server and mail client and mail server applications. The TLS-EAp extension is leveraging existing user credential and profile in AAA server. In addition, you have flexibility to choose different authentication method using EAP. You can use token based authentication or client Certificate based authentication.

What I still do not understand completely is the Client side integration into existing software, e.g. Firefox which has its own TLS implementation. So, theoretically you need to modify the TLS implementation of each Client program that it can handle the InterimAuth Message and forward the following EAPMessages to the EAP-Infrastructure.

...

What kind of mail client/mail server and web client/web server are you using?

Well I think we'll use Firefox / Apache2.

Best Regards Martin - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

I think I need to clarify my question a little:

...

we're trying to setup a freeradius / apache installation that allows us to authenticate and authorize users with *certificates* towards a website.

We want to have *multiple* services, not only just one service. If we would only have one service, we could of cause use certificate revocation lists, as Ivan Kalik suggested in a mail to me. So, we first want to authenticate the user and later authorize him for finding out, if she has the rights to access the desired service. Best regards, M.