Using CF with a CAC on Apache - getting CN, but I need to get Principal Name - please advise

Nevermind.. we can go ahead and close this.  As it turns out, I thought we needed to authenticate against this value, but as it turns out this is not the case (lack of communication.)

Apologies for anyone who took time to give this thought.

V/r,

^ _ ^

My boss found something.  We modified our mod_jk (or was it mod_ssl?)** file to include the following:

setEnvVar SSL_CLIENT_SAN_OTHER_MSUPN_N

But even after rebooting the Apache and CF servers, no love.  The above was supposed to add the Subject Alternative Name to the CGI scope, which contains the Principal Name, but it's not adding to the CGI scope.  It's not null or blank, it isn't present in the scope.  Anyone?

V/r,

^ _ ^

EDIT:  We are proxying to DISA servers for the certificates.  Could it be that the DISA proxy isn't supplying this?

** It was httpd-ssl.conf.

All,

We are approaching crunchtime.  Does ANYONE know what to add or do with Apache to get the Subject Alternative Name / Principal Name passed to CF Server?  I've been Googling for days and have not found it, yet.

V/r,

^ _ ^

You should be able to create whatever CGI variables you want using the SetEnv directive. You shouldn't even have to modify the mod_jk file to do that. Beyond that, I don't know enough about what variables are sent by CACs to provide a more detailed helpful answer. Sorry.

Dave Watts, Eidolon LLC