Support RespondToUnauthenticatedClients PATCH
RespondToUnauthenticatedClients allows users to explicitly select mTLS
as their only authentication mechanism, thus significantly reducing
their code exposure to unauthenticated clients.
From the Redfish specification
```
The RespondToUnauthenticatedClients property within the
ClientCertificate property within the MFA property of the AccountService
resource controls the response behavior when an invalid certificate is
provided by the client.
• If the property contains true or is not
supported by the service, the service shall not fail the TLS handshake.
This is to allow the service to send error messages or unauthenticated
resources to the client.
• If the property contains false , the service
shall fail the TLS handshake.
```
This commit implements that behavior.
This also has some added benefits in that we no longer have to check the
filesystem for every connection, as TLS is controlled explicitly, and
not whether or not a root cert is in place.
Note, this also implements a TODO to disable cookie auth when using
mTLS. Clients can still use IsAuthenticated to determine if they are
authenticated on request.
Tested:
Run scripts/generate_auth_certs.py to set up a root certificate and
client certificate. This verifies that mTLS as optional has not been
broken. Script succeeds.
```
PATCH /redfish/v1/AccountService
{"MultiFactorAuth": {"ClientCertificate": {"RespondToUnauthenticatedClients": false}}}
```
GET /redfish/v1
without a client certificate now fails with an ssl verification error
GET /redfish/v1
with a client certificate returns the result
```
PATCH /redfish/v1/AccountService
{"MultiFactorAuth": {"ClientCertificate": {"RespondToUnauthenticatedClients": false}}}
With certificate returns non mTLS functionality.
```
Change-Id: I5a9d6d6b1698bff83ab62b1f760afed6555849c9
Signed-off-by: Ed Tanous <ed@tanous.net>
diff --git a/include/ssl_key_handler.hpp b/include/ssl_key_handler.hpp
index a8bcfa5..ce1e638 100644
--- a/include/ssl_key_handler.hpp
+++ b/include/ssl_key_handler.hpp
@@ -4,6 +4,7 @@
#include "logging.hpp"
#include "ossl_random.hpp"
+#include "persistent_data.hpp"
#include <boost/beast/core/file_posix.hpp>
@@ -604,11 +605,23 @@
BMCWEB_LOG_CRITICAL("Couldn't get server context");
return nullptr;
}
+ const persistent_data::AuthConfigMethods& c =
+ persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
- // BIG WARNING: This needs to stay disabled, as there will always be
- // unauthenticated endpoints
- // mSslContext->set_verify_mode(boost::asio::ssl::verify_peer);
+ boost::asio::ssl::verify_mode mode = boost::asio::ssl::verify_peer;
+ if (c.tlsStrict)
+ {
+ BMCWEB_LOG_DEBUG("Setting verify peer");
+ mode |= boost::asio::ssl::verify_fail_if_no_peer_cert;
+ }
+ boost::system::error_code ec;
+ sslCtx.set_verify_mode(mode, ec);
+ if (ec)
+ {
+ BMCWEB_LOG_DEBUG("Failed to set verify mode {}", ec.message());
+ return nullptr;
+ }
SSL_CTX_set_options(sslCtx.native_handle(), SSL_OP_NO_RENEGOTIATION);
if constexpr (BMCWEB_EXPERIMENTAL_HTTP2)