Issuer documentation

* Documentation for the "issuer" option of the provider.
* More info of the format of the accepted file
* Print out the value of `SSL_CLIENT_I_DN` also when it is not match the issuer.

cmd/csaf_provider/controller.go

@@ -82,11 +82,11 @@ func (c *controller) auth(
 
 		verify := os.Getenv("SSL_CLIENT_VERIFY")
 		log.Printf("SSL_CLIENT_VERIFY: %s\n", verify)
+		log.Printf("ca: %s\n", os.Getenv("SSL_CLIENT_I_DN"))
 
 		switch {
 		case verify == "SUCCESS" && (c.cfg.Issuer == nil || *c.cfg.Issuer == os.Getenv("SSL_CLIENT_I_DN")):
 			log.Printf("user: %s\n", os.Getenv("SSL_CLIENT_S_DN"))
-			log.Printf("ca: %s\n", os.Getenv("SSL_CLIENT_I_DN"))
 		case c.cfg.Password == nil:
 			log.Println("No password set, declining access.")
 			http.Error(rw, http.StatusText(http.StatusForbidden), http.StatusForbidden)

docs/client-certificate-setup.md

@@ -38,6 +38,7 @@ each which a single `if` that matches the `$ssl_client_i_dn` variable
 to CAs that you would want to allow for that location.
 
 If you want to restrict the access to the web-interface of the `csaf_provider` for only some TLS client certificates, the CA issuer of these certificates should be assigned to the `issuer` key in the `/user/lib/csaf/config.toml` file e.g. `issuer = "C=DE,O=CSAF Tools Development (internal),CN=Tester" `.
+To inspect the accepted format for this field you can check the value of the `ca:` in the nginx log file `/var/log/nginx/error.log`.
 
 Reload or restart nginx to apply the changes (e.g. `systemctl reload nginx`
 on Debian or Ubuntu.)

docs/provider-setup.md

@@ -132,3 +132,4 @@ Provider has many config options described as following:
  - dynamic_provider_metadata: Take the publisher from the CSAF document. Default: `false`.
  - publisher: Set the publisher. Default: `{"category"= "vendor", "name"= "Example", "namespace"= "https://example.com"}`.
  - upload_limit: Set the upload limit  size of the file. Default: `50 MiB`.
+ - issuer: The issuer of the CA, which if set, restricts the writing permission and the accessing to the web-interface to only the client certificates signed with this CA.