Using CF with a CAC on Apache - getting CN, but I need to get Principal Name - please advise

[WolfShade]

Hello, all,

We are using Apache web server and have modded the mod_jk file to pass things like CN to ColdFusion Server.  This has worked just fine for many, many years.  However, we will soon be experiencing a change with our CACs that has us scrambling to make changes before the deadline.

I'd like to switch our apps to authenticate via Principal Name instead of CN.  What changes do I need to make to our Apache config files to pass Principal Name to CF Server?

V/r,

^ _ ^

[Dave Watts]

You should be able to create whatever CGI variables you want using the SetEnv directive. You shouldn't even have to modify the mod_jk file to do that. Beyond that, I don't know enough about what variables are sent by CACs to provide a more detailed helpful answer. Sorry.

Dave Watts, Eidolon LLC

[WolfShade]

All,

We are approaching crunchtime.  Does ANYONE know what to add or do with Apache to get the Subject Alternative Name / Principal Name passed to CF Server?  I've been Googling for days and have not found it, yet.

V/r,

^ _ ^

[WolfShade]

My boss found something.  We modified our mod_jk (or was it mod_ssl?)** file to include the following:

setEnvVar SSL_CLIENT_SAN_OTHER_MSUPN_N

But even after rebooting the Apache and CF servers, no love.  The above was supposed to add the Subject Alternative Name to the CGI scope, which contains the Principal Name, but it's not adding to the CGI scope.  It's not null or blank, it isn't present in the scope.  Anyone?

V/r,

^ _ ^

EDIT:  We are proxying to DISA servers for the certificates.  Could it be that the DISA proxy isn't supplying this?

** It was httpd-ssl.conf.

[WolfShade]

Nevermind.. we can go ahead and close this.  As it turns out, I thought we needed to authenticate against this value, but as it turns out this is not the case (lack of communication.)

Apologies for anyone who took time to give this thought.

V/r,

^ _ ^