With cas-server-support-x509, a certificate is indeed treated as valid :
1- if it matches a trusted issuer dn (subjectDnPattern)...
2- ...within a specified range of intermediate CAs (maxPathLength),
3- if it's not expired (and already valid),
4- if its key usage validate a optionally specified one.
but it doesn't check any CertificateRevocationList (CRL) (yet?).
If you want this check, the easiest way is to rely on mod_ssl installed on a
apache frontal webserver. The SSLCARevocationPath directive allows you specify a
list of CRLs the certificate will be checked against.
You can also develop your own authentication handler....
Romain
Pavlos Drandakis a écrit :
> Hello all,
>
> From what I understand, a certificate is treated as valid if current
> time (when checking) is between certificate's creation and expiration
> time. So if a revoked certificate has not expired yet, is considered
> valid and access is granted, when using X509 authentication. Is there
> any way to prevent users from logging into CAS when presenting revoked
> certificates?
>
> Thanks,
>
> Pavlos
>
> (Server Configuration: CAS 3.2.1, Tomcat 6.0.14 with APR support)
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> cas-dev mailing list
>
cas-dev@...
>
http://tp.its.yale.edu/mailman/listinfo/cas-dev_______________________________________________
cas-dev mailing list
cas-dev@...
http://tp.its.yale.edu/mailman/listinfo/cas-dev
