gentoo/identity.gentoo.org — pull request #34 by mgorny (2013-08-01 21:46:08+00:00)
Title: Simple SSL client certificate auth

The auth is based on matching e-mail addresses from valid (and trusted) certificates onto system users.

Whenever user requests SSL cert auth, he is redirected to a dedicated vhost where the HTTP server requests the certificate. Once there, ssl-auth view checks the verification result and obtains e-mail addresses from the certificate. The e-mail addresses are compared to
system users and if a match occurs, an authentication token is created.

The ssl-auth view redirects back to login, passing either the token, or error message. If a valid token is passed, ExternalBackend is used to sucessfully authenticate the user. Otherwise, the error message is printed alike regular login messages.