Bug 25794 - Add PKI/x509/client SSL authentication to REST API
Summary: Add PKI/x509/client SSL authentication to REST API
Status: RESOLVED WISHLIST
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-06-18 03:10 UTC by David Cook
Modified: 2022-12-06 06:31 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2020-06-18 03:10:49 UTC
It could be useful to add PKI/x509/client SSL authentication to the REST API to ease machine-to-machine interactions.

A vendor could set up all their Koha instances to trust certificates signed by the a vendor's certificate authority public key. Then all new API consumers could just get certificates issued by the vendor's CA.

That said, I suppose authorization would still be a problem. With Bug 6296, they were still mapping the certificate to a Koha user.

And then there's the issue of how to handle revoked certificates. 

Maybe it is best just to rely on OAuth2 and Basic Auth.
Comment 1 David Cook 2020-06-18 03:19:05 UTC
"OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens" at https://tools.ietf.org/html/rfc8705 could be interesting... although it still has the per-implementation issue of certificate revocation management...
Comment 2 David Cook 2020-06-25 02:51:38 UTC
I was looking at FreeIPA (https://en.wikipedia.org/wiki/FreeIPA) and it got me on to DogTag (https://www.dogtagpki.org/wiki/PKI_Main_Page), which is an open source certificate authority that also supports OCSP for checking Certificate Revocation Lists.