[Security] Add caddy server configuration for Client Authentication (X509)

[Spomky]

This PR adds a block to show how to configure Caddy Server.
Please note that this only works with SF6.3 (linked to #17582)

[Spomky]

Build errors from "2023-03-31 08:18:34"
Error while processing "code-block" directive: "Unsupported code block
language "caddy". Added it in
SymfonyDocsBuilder\Renderers\CodeNodeRenderer" in file "security"

How can I create a block definition for Caddy? Is it possible from this repository?

[Spomky]

Ping @francislavoie just in case of.

[francislavoie]

Seems fine to me. Is the subject the only field someone might care about? Wouldn't they want the fingerprint and/or the full client cert as well potentially?

Might want to point to Caddy's docs where it documents the placeholders for the client cert. Also FYI there's these Caddyfile placeholder shortcuts that can be used to shorten the config https://caddyserver.com/docs/caddyfile/concepts#placeholders

[Spomky]

Actually, in one of my project, I also use the fingerprint and other data you mentioned

  env SSL_CLIENT_S_FINGERPRINT {http.request.tls.client.fingerprint}
  env SSL_CLIENT_S_CERTIFICATE {http.request.tls.client.certificate_der_base64}
  env SSL_CLIENT_S_ISSUER {http.request.tls.client.issuer}
  env SSL_CLIENT_S_SERIAL {http.request.tls.client.serial}
  env SSL_CLIENT_S_DN {http.request.tls.client.subject}

But those additional ones are not required nor understood by the authenticator, that is why I did not add them in the documentation page.

[francislavoie]

Might be worth mentioning it in case the user may need those additional fields for manual validation? You could put # comments on that chunk to say they're not used by Symfony 🤷‍♂️

[Spomky]

Indeed you are right.
I updated the PR and added all other relevant env vars that could be used.

[francislavoie]

You could also switch to the short form as per my link. There's no downside to it.

[Spomky]

Many thanks 👌🏼. Done!

[javiereguiluz]

Thanks Florent! This is now merged.

[javiereguiluz]

The missing caddy config format is being added in symfony-tools/docs-builder#153