At a high level, we would like to setup X.509 Client Certificate authentication between Web browser and the SAML 2 Identity Provider (IdP), and SAML 2 authentication for BOC and HANA. In this way, the end user can simply click on the BOC URL in the Web browser's bookmarks, and log straight into BOC without having to enter username and password manually.
Unfortunately this setup is not as straightforward as Kerberos/SPNego which I blogged earlier. Client Certificate authentication is part of the SSL protocol, and since there is a reverse proxy that terminates the SSL connection, native Client Certificate authentication cannot happen between the Web browser and the SAML 2 IdP. However, the solution can still work if the following conditions are met:
1. The reverse proxy is capable of wrapping the client certificate into HTTP headers and pass them onto the SAML 2 IdP
2. The SAML 2 IdP is capable of authenticating a user based on HTTP headers that contain the user's client certificate
Apparently this would become a custom/proprietary solution, and not all SAML 2 IdPs support this custom client certificate authentication mechanism. And more importantly, as this custom client certificate authentication process is not part of the SSL handshake mechanism anymore, it loses the strong verification of the user's certificate. Therefore from the security perspective, it is very important for the SAML 2 IdP to accept client certificates from a trustworthy reverse proxy only, in this case, the BOC system's reverse proxy.
The following diagram illustrates how it works. Hopefully this is straightforward enough, but I'd like to point out the pros and cons of this solution:
- This end-to-end SSO solution works on both Intranet and Internet
- Needs a PKI infrastructure in place to distribute and manage user's client certificate.
- Not all SAML 2 IdP and reverse proxy support this custom client certificate authentication mechanism.
- Performance is slightly slower than Kerberos/SPNego.
On the Apache reverse proxy, we need to configure it to perform the following things:
1. Enable Client Certificate authentication
2. Wrap the client certificate information into HTTP headers, and forward them onto the SAML IdP. Note that these headers can be pretty long, so we need to carefully configure the Apache rules so that they are forwarded to the SAML 2 IdP system only, not to BOC or HANA, for performance reasons.
# Configure mod_proxy_html to understand HTML4/XHTML1
Listen 443 https