X.509 Client Certificate Authentication

When using client certificates, your webserver is doing all the authentication process itself. With Apache, for example, you would use the SSLVerifyClient Require directive.

Enable the x509 authentication for a particular firewall in the security configuration:

1
2
3
4
5
6
7

# app/config/security.yml
security:
    firewalls:
        secured_area:
            pattern: ^/
            x509:
                provider: your_user_provider

1
2
3
4
5
6
7
8
9
10
11

<?xml version="1.0" ?>
<!-- app/config/security.xml -->
<srv:container xmlns="http://symfony.com/schema/dic/security"
    xmlns:srv="http://symfony.com/schema/dic/services">

    <config>
        <firewall name="secured_area" pattern="^/">
            <x509 provider="your_user_provider"/>
        </firewall>
    </config>
</srv:container>

1
2
3
4
5
6
7
8
9
10
11

// app/config/security.php
$container->loadFromExtension('security', array(
    'firewalls' => array(
        'secured_area' => array(
            'pattern' => '^/'
            'x509'    => array(
                'provider' => 'your_user_provider',
            ),
        ),
    ),
));

By default, the firewall provides the SSL_CLIENT_S_DN_Email variable to the user provider, and sets the SSL_CLIENT_S_DN as credentials in the PreAuthenticatedToken. You can override these by setting the user and the credentials keys in the x509 firewall configuration respectively.