SSL certs for connection

[jcpunk]

I'm planning to use this plugin for automated posting.

Since the XMLRPC gateway has so much functionality I'd like to add SSL certificate auth to the Client methods.

May I request a feature enhancement where I can pass in certificate files to the client for connection security?

[maxcutler]

Can you explain the request in more detail? This library will already talk to a server over HTTPS without issue if you provide an HTTPS URL to the Client constructor.

[jcpunk]

I'd like to provide a client cert for the remote server to validate.

[maxcutler]

Are you just asking for validation of the server's SSL cert?

Or do you have a custom WordPress installation that has added additional auth checks on XML-RPC methods to verify client identity via certificates? If that's the case, I would need much more detail about what you've done so that I could advise how you could talk to it via my library.

Or did you mean something different? If so, please provide more details or pointer to documentation somewhere that explains what you're trying to do. Otherwise I'm not sure what my library would have to do to help you.

[jcpunk]

I was looking into the wordpress plugin: http://wordpress.org/plugins/http-authentication/

with the following apache stanzas:

<Location /wp-login.php>
SSLVerifyClient require
SSLVerifyDepth 1
SSLRequireSSL
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate +FakeBasicAuth
SSLUserName SSL_CLIENT_S_DN_CN_1
SSLRequire %{SSL_CLIENT_I_DN} eq ""
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128

Apache does all the work for setting the REMOTE_USER environment to my wordpress user name, the plugin above then uses the environment variable as a valid auth source ie: If REMOTE_USER is a valid username, you are logged in automatically as that username.

From the library perspective, if I can - as part of the HTTPS connection - provide a client certificate, the rest happens automatically. I just need to provide the certificate to apache when it asks for my client certificate.

Is that explanation helpful for what I'm trying?

[jcpunk]

looks like the xmlrpc client doesn't even support this.... :(

[maxcutler]

It actually does, I've been investigating this. The Python xmlrpclib client does support providing a Transport override, and that override could handle supplying an SSL client cert (e.g., using the popular requests library).

I've been too busy the past week to try this, but if you're willing to wait a little longer I may be able to take a look.

[jcpunk]

I'm absolutely interested and totally willing to wait! Seems I missed that alternate library. Couldn't find much good doc on the Transport override.