#38 CAC Authentication (Pass-Through)

[Matthew Barker]

We authenticate all users to our webserver via Common Access Cards (CAC). I also have LDAP set up within phpIPAM on this same server and it works fine. Now I am just wondering if you could add the ability to authenticate LDAP users via their their CAC (which are tied to AD).

[Matthew Barker]

Basically, I am thinking this would need to do 3 things:

1. Verify the userPrincipalName exists in Active Directory
2. Get the cn from the AD account that was identified via userPrincipalName
3. Authenticate the user in phpIPAM

Might not be the best way to do it, but this is what I am using to get the ID from the CAC to match against the userPrincipalName field in active directory.

$cert_data = ($_SERVER['SSL_CLIENT_S_DN_CN']); // Gets the info from the CAC
$upn = strrchr($cert_data, "."); // Strips away what we don't need based on the last period
$upn = ltrim ($upn, "."); // Removes the period, leaving only the UPN
--

Based on what is in the $upn variable is what an LDAP query would match against a user id (cn) in AD