Difference between revisions of "How to set up a secure webdav area on an Apache 2.0 server that is mountable from windows"

From UConn PAN
Jump to navigation Jump to search
 
(2 intermediate revisions by the same user not shown)
Line 17: Line 17:
 
This seemed to work at first, in that I was able to access files using the normal Windows explorer interface.  This seems to be because explorer had cached the directory contents from a former session, because a bit later I tried to refresh the window and it failed with the following complaint
 
This seemed to work at first, in that I was able to access files using the normal Windows explorer interface.  This seems to be because explorer had cached the directory contents from a former session, because a bit later I tried to refresh the window and it failed with the following complaint
 
<pre>
 
<pre>
−
Documents in this folder are not available. The folder may have been moved or deleted, or network problems may be preventing a connection to the server.
+
Documents in this folder are not available.
 +
The folder may have been moved or deleted,
 +
or network problems may be preventing a connection
 +
to the server.
 
</pre>
 
</pre>
−
The Apache server ssl error logs showed SSL library error reason code 199, which means that the client did not provide a client certificate.  It seems that the Windows XP webdav client is not smart enough to supply a client certificate, even though the interface that explorer uses to fetch a file from the same directory (probably a ie component) does.  Bummer.
+
The Apache server ssl error logs showed SSL library error reason code 199, which means that the client did not provide a client certificate.  It seems that the Windows XP webdav client is not smart enough to supply a client certificate, even though the interface that explorer uses to fetch a file from the same directory (probably an IE component) does.  Bummer.
  
 
== Authentication using HTTP Basic Auth ==
 
== Authentication using HTTP Basic Auth ==
  
−
Alternatively one might chose to have just one shared webdav area for all users, and use basic http authentication based on passwords.
+
Alternatively one can chose to use basic http authentication based on passwords.  This seems to be the preferred solution among people who have written documentation that I found on the web.  Compared to pki it is clunky, but at least it works with Windows explorer.
 
<pre>
 
<pre>
 
Alias /davusers/ "/home/www/davusers/"
 
Alias /davusers/ "/home/www/davusers/"

Latest revision as of 02:56, 29 August 2007

There is plenty of help on the web regarding how to set up a webdav area on an Apache 2.0 server using the mod_dav apache module. If this is enabled on an area of the site secured with SSL/TLS (reachable by urls beginning with https:) there are a few extra steps, also widely documented. What was not so easy to figure out how to do was how to do client authentication based on client certificates.

Authentication with a Client Certificate

Most of the sites out there assume that people should use http basic authentication and type passwords all of the time. I wanted to use my client certificate instead. This should be possible if you are willing to configure a separate webdav area for each user. In this case, one can configure a webdav directory for each user in ssl.conf as follows. 

Alias /davusers/ "/home/www/davusers/"
<Directory "/home/www/davusers/newman/">
    DAV On
    SSLVerifyClient on
    SSLVerifyDepth  10
    SSLRequire %{SSL_CLIENT_S_DN_CN} =~ m/^Alfred E\. Newman/
</Directory>

Note the trailing slashes on all of the webdav area directories, both actual and alias. These slashes are necessary in order to be compatible with the Windows XP explorer webdav interface.

This seemed to work at first, in that I was able to access files using the normal Windows explorer interface. This seems to be because explorer had cached the directory contents from a former session, because a bit later I tried to refresh the window and it failed with the following complaint 

Documents in this folder are not available.
The folder may have been moved or deleted,
or network problems may be preventing a connection
to the server.

The Apache server ssl error logs showed SSL library error reason code 199, which means that the client did not provide a client certificate. It seems that the Windows XP webdav client is not smart enough to supply a client certificate, even though the interface that explorer uses to fetch a file from the same directory (probably an IE component) does. Bummer.

Authentication using HTTP Basic Auth

Alternatively one can chose to use basic http authentication based on passwords. This seems to be the preferred solution among people who have written documentation that I found on the web. Compared to pki it is clunky, but at least it works with Windows explorer. 

Alias /davusers/ "/home/www/davusers/"
<Directory "/home/www/davusers/newman/">
    DAV On
    AuthType Basic
    AuthName "WebDAV Restricted"
    AuthUserFile /home/www/.htpasswd/webdav.htpasswd
    <LimitExcept OPTIONS>
        Require user newman
    </LimitExcept>
    SSLVerifyClient off
</Directory>
Retrieved from "https://zeus.phys.uconn.edu/wiki/index.php?title=How_to_set_up_a_secure_webdav_area_on_an_Apache_2.0_server_that_is_mountable_from_windows&oldid=2488"