OpenID-eID - Revision history

PhilippeTeuwen: /* Adding Belgian Government Root certificates */

2012-07-20T23:26:42Z

Adding Belgian Government Root certificates

← Older revision		Revision as of 23:26, 20 July 2012
Line 36:		Line 36:
	pkcs15-tool --read-certificate 04 > /etc/apache2/ssl/ca/belgium.crt		pkcs15-tool --read-certificate 04 > /etc/apache2/ssl/ca/belgium.crt
	pkcs15-tool --read-certificate 06 >> /etc/apache2/ssl/ca/belgium.crt		pkcs15-tool --read-certificate 06 >> /etc/apache2/ssl/ca/belgium.crt
			Note that with recent cards I had to add the GlobalSign certificate too.
	Then add client certificate requirements to /etc/apache2/sites-available/default-ssl		<br>Then add client certificate requirements to /etc/apache2/sites-available/default-ssl
	SSLCACertificateFile /etc/apache2/ssl/ca/belgium.crt		SSLCACertificateFile /etc/apache2/ssl/ca/belgium.crt
	SSLOptions +StrictRequire		SSLOptions +StrictRequire
Line 42:		Line 43:
	SSLVerifyDepth 10		SSLVerifyDepth 10
	<Location />		<Location />
	# accept only certificates emitted by Citizen CA:		# accept only certificates emitted by Citizen CA or Foreigner CA:
	SSLRequire %{SSL_CLIENT_I_DN_C} eq "BE" \		SSLRequire %{SSL_CLIENT_I_DN_C} eq "BE" \
	and %{SSL_CLIENT_I_DN_CN} in {"Citizen CA"}		and ( %{SSL_CLIENT_I_DN_CN} in {"Citizen CA"} \
			or %{SSL_CLIENT_I_DN_CN} in {"Foreigner CA"} )
	</Location>		</Location>
	According to the doc, because of a bug in Internet Explorer, you also need to add GlobalSign Root certificate...		According to the doc, because of a bug in Internet Explorer, you also need to add GlobalSign Root certificate...

PhilippeTeuwen: /* Retrieving citizens' certificate information */

2012-02-09T17:38:58Z

Retrieving citizens' certificate information

← Older revision		Revision as of 17:38, 9 February 2012
Line 57:		Line 57:
	And the user's name with		And the user's name with
	$_SERVER['SSL_CLIENT_S_DN_CN']		$_SERVER['SSL_CLIENT_S_DN_CN']
			If those variables are not exported in your environment, check if StdEnvVars is in your Apache SSLOptions for all scripts. On a regular Debian I get:
			<pre>
			<FilesMatch "\.(cgi\|shtml\|phtml\|php)$">
			SSLOptions +StdEnvVars
			</FilesMatch>
			<Directory /usr/lib/cgi-bin>
			SSLOptions +StdEnvVars
			</Directory>
			</pre>

	===TODO: cf [http://www.belgium.be/zip/eid_authentication_proxy_fr.html apache SSL reverse proxy] proposed by the government===		===TODO: cf [http://www.belgium.be/zip/eid_authentication_proxy_fr.html apache SSL reverse proxy] proposed by the government===

PhilippeTeuwen: /* Adding Belgian Government Root certificates */

2012-02-09T17:34:47Z

Adding Belgian Government Root certificates

← Older revision		Revision as of 17:34, 9 February 2012
Line 47:		Line 47:
	</Location>		</Location>
	According to the doc, because of a bug in Internet Explorer, you also need to add GlobalSign Root certificate...		According to the doc, because of a bug in Internet Explorer, you also need to add GlobalSign Root certificate...

			Xavier Dury proposed to use directly his eID to access a specific directory on an Apache server by "abusing" the Location directive above:
			<br>You can add sth like SSLRequire %{SSL_CLIENT_S_DN} but beware of the format of the DN string, it's not the same as with openssl. It should look like "/C=BE/CN=My Name..." and not "C=BE, CN=My Name...".
			<br>Moreover special characters must be encoded & protected, e.g. Sébastien has to be coded as <code>S\\xC3\\xA9bastien</code>.

	===Retrieving citizens' certificate information===		===Retrieving citizens' certificate information===
	The user's distinguish name can be retrieved from php with		The user's distinguish name can be retrieved from php with

PhilippeTeuwen: Reverted edits by Etegohy (Talk) to last revision by Karel

2010-11-24T20:37:54Z

Reverted edits by Etegohy (Talk) to last revision by Karel

Can't load revision 6888

at 08:22, 24 November 2010

2010-11-24T08:22:17Z

Can't load revision 6738

Karel: the opensc package is needed for pkcs15-tool

2008-09-19T12:28:23Z

the opensc package is needed for pkcs15-tool

← Older revision		Revision as of 12:28, 19 September 2008
Line 3:		Line 3:
	===Install packages===		===Install packages===
	Let's get apache2, php5 and openssl stuff:		Let's get apache2, php5 and openssl stuff:
	apt-get install apache2-utils apache2-mpm-prefork libapache2-mod-php5 php5 openssl ssl-cert		apt-get install apache2-utils apache2-mpm-prefork libapache2-mod-php5 php5 openssl ssl-cert opensc

	===Setup apache server with SSL===		===Setup apache server with SSL===

PhilippeTeuwen: /* Hacking phpMyID */

2008-09-18T12:42:28Z

Hacking phpMyID

← Older revision		Revision as of 12:42, 18 September 2008
Line 86:		Line 86:
	** avoid clashes		** avoid clashes
	** RRN retrieval more or less robust against brute force retrieval		** RRN retrieval more or less robust against brute force retrieval
			* So '''about security & clashes''', the hash is very very safe, the others, well, it depends how likely is your name...
	* I added a discover mode which tells you what are your OpenIDs given your own eID, you can try here:		* I added a discover mode which tells you what are your OpenIDs given your own eID, you can try here:
	http://id.yobi.be/?openid.mode=discover		http://id.yobi.be/?openid.mode=discover

PhilippeTeuwen: /* Hacking phpMyID */

2008-09-18T12:41:05Z

Hacking phpMyID

← Older revision		Revision as of 12:41, 18 September 2008
Line 81:		Line 81:
	* I could validate the client certificate against the root CA and I could extract the data of the certificate		* I could validate the client certificate against the root CA and I could extract the data of the certificate
	* I could create various OpenIDs based on the certificate data<br>Everything is extracted only from the names and RRN, not on the serial nr of the certificate or any part prone to be changed if you've to renew your ID card! (unless they change the way they write your name on the certificate...)		* I could create various OpenIDs based on the certificate data<br>Everything is extracted only from the names and RRN, not on the serial nr of the certificate or any part prone to be changed if you've to renew your ID card! (unless they change the way they write your name on the certificate...)
			* I still consider RRN as sensitive data so the IDs I can provide must be a balance between several factors:
			** friendliness (easy to remember)
			** displaying your name or not?
			** avoid clashes
			** RRN retrieval more or less robust against brute force retrieval
	* I added a discover mode which tells you what are your OpenIDs given your own eID, you can try here:		* I added a discover mode which tells you what are your OpenIDs given your own eID, you can try here:
	http://id.yobi.be/?openid.mode=discover		http://id.yobi.be/?openid.mode=discover
Line 87:		Line 92:
	http://id.yobi.be/?id=philippe.teuwen.159		http://id.yobi.be/?id=philippe.teuwen.159
	http://id.yobi.be/?id=philippe.yvon.teuwen		http://id.yobi.be/?id=philippe.yvon.teuwen
			Another kind of ID could be
			id=firstname.lastname.Hash(RRN\|firstname2\|initial3\|firstname\|lastname)
			So it tells your name but still hides RRN is a moderately hard to brute-force hash as you've to guess RRN but also your second firstname & initial of the third firstname (if you've a single firstname you're out of luck, I've 5 firstnames!)

	Estonian [https://openid.ee/about/english counterpart] plans to provide simply firstname.lastname and to build an index in case of clashes.<br>		Estonian [https://openid.ee/about/english counterpart] plans to provide simply firstname.lastname and to build an index in case of clashes.<br>
	But this requires to have a stateful server and I don't want that, I want anybody to build his own service and the generated OpenIDs will always be the same, only depending on the certificate data, not on "who came first".<br>Otherwise imagine the mess if the server data gets destroyed!		But this requires to have a stateful server and I don't want that, I want anybody to build his own service and the generated OpenIDs will always be the same, only depending on the certificate data, not on "who came first".<br>Otherwise imagine the mess if the server data gets destroyed!

PhilippeTeuwen: /* Hacking [http://siege.org/projects/phpMyID/ phpMyID] */

2008-03-07T06:11:31Z

Hacking [http://siege.org/projects/phpMyID/ phpMyID]

← Older revision		Revision as of 06:11, 7 March 2008
Line 94:		Line 94:
	* CRL & cf TODO patches above		* CRL & cf TODO patches above
	* Maybe some stateful stuff on the server for minor info: pavatar, microid...		* Maybe some stateful stuff on the server for minor info: pavatar, microid...
			* Check if server is able to do stateful associations
			* Support also for CAcert client certificates, be our own CA?
			* Clean-up server and delegate URLs
			** e.g. http://id.yobi.be & http://id.yobi.be/ae96fba0cd9515cd (or xri?)
	* Move to php-openid		* Move to php-openid
	Security:		Security:

PhilippeTeuwen: /* Hacking [http://siege.org/projects/phpMyID/ phpMyID] */

2008-03-07T06:08:35Z

Hacking [http://siege.org/projects/phpMyID/ phpMyID]

← Older revision		Revision as of 06:08, 7 March 2008
Line 76:		Line 76:
	* redirect authorization to HTTPS as we'll deal with SSL client certificates		* redirect authorization to HTTPS as we'll deal with SSL client certificates
	* TODO		* TODO
	* [http://id.yobi.be/MyID.phps current source code]		* [http://id.yobi.be/MyID.phps current source code of the hacked phpMyID]

	Status:		Status: