Nginx map client certificate to REMOTE_USER for uWSGI with fallback to basic auth? - ssl

Question

I'm using Nginx with uWSGI to serve Mercurial; it does basic auth over SSL (Nginx is the SSL terminator; it doesn't get passed on to Hg), but due to the limited security of basic auth even over SSL, as discussed at various places including this site, I want to allow users to connect with client certificates as well, something that TortoiseHg for example supports.
ssl_verify_client optional;
...
map $ssl_client_s_dn $ssl_client_s_dn_cn
{
default "";
~/CN=(?<CN>[^/]+) $CN;
};
...
location /
{
uwsgi_pass unix:/run/uwsgi/app/hgweb/socket;
include uwsgi_params;
uwsgi_param SERVER_ADDR $server_addr;
uwsgi_param REMOTE_USER $ssl_client_s_dn_cn;
#uwsgi_param REMOTE_USER $remote_user;
#auth_basic "Mercurial repositories";
#auth_basic_user_file /srv/hg/.htpasswd;
}
So I treat the CN as a username.
But how do I make it fallback to basic auth when there's no client certificate (and preferably not when there is a certificate but its verification fails -- just error in that case)? An example I found does it by having a separate server block listening on another port, which I want to avoid: https://github.com/winne27/nginx-cert-and-basic-auth/blob/master/nginx-example.conf
Additionally, in some examples I've seen the following checks in location; are they necessary? if ($ssl_client_verify != SUCCESS) { return 496; } if ($ssl_client_s_dn_cn !~ "^[a-z0-9]{1,10}$") { return 496; } Given http://wiki.nginx.org/IfIsEvil I thought it best to avoid using if.

Answer 1

Nginx 1.11 and 1.12 changed the quoting of $ssl_client_s_dn_cn.
If you come here and have headache, try this regexp instead:
map $ssl_client_s_dn $ssl_client_s_dn_cn {
default "should_not_happen";
~CN=(?<CN>[^/,\"]+) $CN;
}

Answer 2

I see two possible solutions, you can either overwrite the uwsgi_param or use $remote_user a default value for the variable $ssl_client_s_dn_cn.
To overwrite the uwsgi_param (this should also work with fastcgi_param), use the map directive as you suggested (just remove the ";" after "}"), and use the if_not_empty parameter for the directive:
uwsgi_param REMOTE_USER $remote_user;
uwsgi_param REMOTE_USER $ssl_client_s_dn_cn if_not_empty;
$ssl_client_s_dn_cn should override $remote_user if present. This approach has the advantage to use the two different variable names separately elsewhere (for example, the log format).
See:
http://nginx.org/en/docs/http/ngx_http_uwsgi_module.html#uwsgi_param
To use $remote_user as the default value for the $ssl_client_s_dn_cn variable when defining the map:
map $ssl_client_s_dn $ssl_client_s_dn_cn
{
default $remote_user;
~/CN=(?<CN>[^/]+) $CN;
}
Please note that the map directive cannot be used at server context, while location should. And also note that Nginx variables cannot be overwritten.