CAC authentication and http headers

Ok, so the fix for this was twofold...

 

 

One: Add an LB_SELECTED function to pass the headers to the server (see below)

 

 

when LB_SELECTED {

 

if {$needcert ==1} {

 

set ssl_array1 [session lookup ssl $id]

 

set ssl_data0 [lindex $ssl_array1 0]

 

set ssl_data1 [lindex $ssl_array1 1]

 

if { $ssl_data0 contains "ok" } {

 

HTTP::header replace "SSLCLientCertStatus" $ssl_data1

 

HTTP::header replace "SSLClientCertVersion" [X509::version $somecert]

 

HTTP::header replace "SSLClientCertSerialNumber" [X509::serial_number $somecert]

 

HTTP::header replace "SSLClientCertIssuer" [X509::issuer $somecert]

 

HTTP::header replace "SSLClientCertNotValidBefore" [X509::not_valid_before $somecert]

 

HTTP::header replace "SSLClientCertNotValidAfter" [X509::not_valid_after $somecert]

 

HTTP::header replace "SSLClientCertSubject" [X509::subject $somecert]

 

}

 

}

 

}

 

 

You could even send the failures through as headers this way too if you want to customize a response page back on the server.

 

 

Two: Add in a HTTP_RESPONSE section to handle the failure responses back to the client.

 

 

It works as intended now!

 

 

Mike