Skip to content

SSL certs for connection #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jcpunk opened this issue May 15, 2014 · 7 comments
Open

SSL certs for connection #60

jcpunk opened this issue May 15, 2014 · 7 comments

Comments

@jcpunk
Copy link

jcpunk commented May 15, 2014

I'm planning to use this plugin for automated posting.

Since the XMLRPC gateway has so much functionality I'd like to add SSL certificate auth to the Client methods.

May I request a feature enhancement where I can pass in certificate files to the client for connection security?

@maxcutler
Copy link
Owner

Can you explain the request in more detail? This library will already talk to a server over HTTPS without issue if you provide an HTTPS URL to the Client constructor.

@jcpunk
Copy link
Author

jcpunk commented May 15, 2014

I'd like to provide a client cert for the remote server to validate.

@maxcutler
Copy link
Owner

Are you just asking for validation of the server's SSL cert?

Or do you have a custom WordPress installation that has added additional auth checks on XML-RPC methods to verify client identity via certificates? If that's the case, I would need much more detail about what you've done so that I could advise how you could talk to it via my library.

Or did you mean something different? If so, please provide more details or pointer to documentation somewhere that explains what you're trying to do. Otherwise I'm not sure what my library would have to do to help you.

@jcpunk
Copy link
Author

jcpunk commented May 15, 2014

I was looking into the wordpress plugin: http://wordpress.org/plugins/http-authentication/

with the following apache stanzas:

<Location /wp-login.php>
SSLVerifyClient require
SSLVerifyDepth 1
SSLRequireSSL
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate +FakeBasicAuth
SSLUserName SSL_CLIENT_S_DN_CN_1
SSLRequire %{SSL_CLIENT_I_DN} eq ""
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128

Apache does all the work for setting the REMOTE_USER environment to my wordpress user name, the plugin above then uses the environment variable as a valid auth source ie: If REMOTE_USER is a valid username, you are logged in automatically as that username.

From the library perspective, if I can - as part of the HTTPS connection - provide a client certificate, the rest happens automatically. I just need to provide the certificate to apache when it asks for my client certificate.

Is that explanation helpful for what I'm trying?

@jcpunk
Copy link
Author

jcpunk commented May 19, 2014

looks like the xmlrpc client doesn't even support this.... :(

@jcpunk jcpunk closed this as completed May 19, 2014
@maxcutler
Copy link
Owner

It actually does, I've been investigating this. The Python xmlrpclib client does support providing a Transport override, and that override could handle supplying an SSL client cert (e.g., using the popular requests library).

I've been too busy the past week to try this, but if you're willing to wait a little longer I may be able to take a look.

@jcpunk
Copy link
Author

jcpunk commented May 19, 2014

I'm absolutely interested and totally willing to wait! Seems I missed that alternate library. Couldn't find much good doc on the Transport override.

@jcpunk jcpunk reopened this May 19, 2014
maxcutler added a commit that referenced this issue Jun 29, 2014
Custom transports have the ability to modify the network behavior of the HTTP requests, to do things like proxying (see #41), timeouts (see #52), SSL certification validation (see #60), and more.
Fixes #61.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants