user authentication via ssl certs in django

Question

I'm writing a web application for a closed user group. It will be served via HTTPS only. The server should check if the user is allowed to access the server by checking the user's SSL certificate. I would prefer to just have a whitelist (ex: field with user cert in userprofile), rather than signing their keys with my CA. As there would be no user/pass, content will depend on which certificate was provided by client.

I know that I can just supply a list of their certs to apache/nginx, but I don't like this solution because I would need to keep this list in two places: apache(access/deny) and Django:auth middleware(content depends on which cert was provided). Maintaining this could be a nightmare.

Is there a nicer way of doing this? Should I let Django handle the SSL?

Answer 1

I have created a django module for this, the implementation available under MIT license on github. Basically the approach is so that:

1. nginx handles all the SSL & Certificate verification stuff
2. Django authentication backend maps the (validated) certificates distinguished name to a whatever User model you are using.