{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/etcd/issues/3916","repository_url":"https://api.github.com/repos/coreos/etcd","labels_url":"https://api.github.com/repos/coreos/etcd/issues/3916/labels{/name}","comments_url":"https://api.github.com/repos/coreos/etcd/issues/3916/comments","events_url":"https://api.github.com/repos/coreos/etcd/issues/3916/events","html_url":"https://github.com/coreos/etcd/pull/3916","id":118529018,"number":3916,"title":"client certificate auth via common name","user":{"login":"roboll","id":1259631,"avatar_url":"https://avatars.githubusercontent.com/u/1259631?v=3","gravatar_id":"","url":"https://api.github.com/users/roboll","html_url":"https://github.com/roboll","followers_url":"https://api.github.com/users/roboll/followers","following_url":"https://api.github.com/users/roboll/following{/other_user}","gists_url":"https://api.github.com/users/roboll/gists{/gist_id}","starred_url":"https://api.github.com/users/roboll/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/roboll/subscriptions","organizations_url":"https://api.github.com/users/roboll/orgs","repos_url":"https://api.github.com/users/roboll/repos","events_url":"https://api.github.com/users/roboll/events{/privacy}","received_events_url":"https://api.github.com/users/roboll/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2015-11-24T04:24:18Z","updated_at":"2016-07-01T02:09:07Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/coreos/etcd/pulls/3916","html_url":"https://github.com/coreos/etcd/pull/3916","diff_url":"https://github.com/coreos/etcd/pull/3916.diff","patch_url":"https://github.com/coreos/etcd/pull/3916.patch"},"body":"This is an initial proof of concept for implementing authentication using the common name on client certificates, as opposed to the current scheme which requires client certificates in conjunction with http basic authentication.\r\n\r\nThis is similar to the way kubernetes implements client authentication, using the common name on client certificates as a username.\r\n\r\nThere are two commits, the first is a small refactor to centralize the existing basic auth code, and the second is an initial implementation of pulling the client username from the certificate.\r\n\r\nThe approach looks like this:\r\n\r\n* if an `Authorization` header exists on the request, do not check the certificate. proceed normally and check credentials.\r\n* if the `Authorization` header is missing, attempt to extract the common name from the presented certificate and authenticate as the specified user (even if the user account specifies a password, the client certificate will bypass that and authenticate)\r\n\r\nWanted to get a bit of review and see if this was something you'd be interested in merging, if so, some considerations before merging..\r\n* gate with a flag (it should be entirely backward compatible, so not sure if that's necessary)\r\n* re-validate the certificate with the ca during authentication? (the authentication code uses the tls sessions validated chains, so as long as the tls config is set up with the ca properly, this should be unnecessary)\r\n* limit user accounts that are accessible via client cert, and/or review the interop with basic auth\r\n* documentation"},"comment":{"url":"https://api.github.com/repos/coreos/etcd/issues/comments/229837172","html_url":"https://github.com/coreos/etcd/pull/3916#issuecomment-229837172","issue_url":"https://api.github.com/repos/coreos/etcd/issues/3916","id":229837172,"user":{"login":"mitake","id":1173955,"avatar_url":"https://avatars.githubusercontent.com/u/1173955?v=3","gravatar_id":"","url":"https://api.github.com/users/mitake","html_url":"https://github.com/mitake","followers_url":"https://api.github.com/users/mitake/followers","following_url":"https://api.github.com/users/mitake/following{/other_user}","gists_url":"https://api.github.com/users/mitake/gists{/gist_id}","starred_url":"https://api.github.com/users/mitake/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mitake/subscriptions","organizations_url":"https://api.github.com/users/mitake/orgs","repos_url":"https://api.github.com/users/mitake/repos","events_url":"https://api.github.com/users/mitake/events{/privacy}","received_events_url":"https://api.github.com/users/mitake/received_events","type":"User","site_admin":false},"created_at":"2016-07-01T02:09:07Z","updated_at":"2016-07-01T02:09:07Z","body":"@ghodss hashed password is replicated to every node of the cluster. Is this problem for you? It is required for enabling authentication on all nodes."}}
{"actor":{"display_login":"mitake"}}