Question

I've read many pages on User Authentication in TWiki. Most them mention in an offhand way that with an SSL enabled webserver it just works. Are there any TWIki topics which say explicitly how SSL with TWiki works?

I have an SSL enabled webserver installed. It appears to be working (eg: if I point a browser at https://my.server.domain/ I get the web pages I expect). However according to twiki/bin/testenv the environment variable REMOTE_USER is still empty.

• TWiki version: September 2001
• Web server: Apache 1.3.20 CAMP
• Server OS: Cygwin 1.3.3 on NT 4.0
• Web browser: IE5.5, Mozilla 0.9.4
• Client OS: W2k, NT4

Any suggestions appreciated. Thanks.

-- MattWilkie - 24 Oct 2001

---

Answers

1

I have not tried this at all, but I believe you need client-side certificates installed for each user, so that the certificate authenticates the user (rather than a password). SteveRoe and JohnTalintyre can probably advise in more detail, but have a look at the Apache and OpenSSL docs for a start.

-- RichardDonkin - 26 Oct 2001

2

Just by using SSL doesn't mean that you are providing a user name. Are you using the .htaccess method of authentication or auth_ldap or ??? We are using Apache with auth_ldap for access to our TWiki. Auth_ldap in this case will pass the REMOTE_USER variable over to TWiki once a successful login has occurred. -- MicahHoffman - 03 Dec 2001

---

thank you Micah. I was missing the crucial point that SSL works in conjunction with authentication mechanisms, not instead of. I was trying to get SSL to work because I have been unsuccessful in getting .htaccess to work. (see the related links below) [ MattWilkie 03 Dec 2001 ]

No Problem Matt. If you'd like more info on using auth_ldap, I'm no expert but I have some experience. -- MicahHoffman - 04 Dec 2001

Related Questions:

• AuthenticationProblem
• IntranetDoubleAuthentication