dp:auth-info()

Returns client authentication information.

Namespace declaration

xmlns:dp="http://www.datapower.com/extensions"

Syntax

dp:auth-info(detail, format)

Parameters

detail

The xs:string that specifies the authentication information to return.

basic-auth-name: When used with HTTP BasicAuth, returns the name from the Authorization HTTP header.; When used with an SFTP server handler over a secure SSH connection, returns the username information from the SFTP client.
basic-auth-password: When used with HTTP BasicAuth, returns the password from the Authorization HTTP header.; When used with an SFTP server handler over a secure SSH connection with password authentication, returns the password information from the SFTP client.
ssh-client-key: Used with an SFTP server handler over a secure SSH connection with public key authentication, returns the contents of the public key of the SFTP client.
ssh-client-key-type: Used with an SFTP server handler over a secure SSH connection with public key authentication, returns the type of the public key, for example ssh-rsa or ssh-dss, of the SFTP client.
ssl-client-cert: Used with TLS-based client authentication and returns the entire base-64 encoded client certificate.
ssl-client-issuer: Used with TLS-based client authentication and returns the issuer DN from the certificate for the client.
ssl-client-subject: Used with TLS-based client authentication and returns the subject DN from the certificate for the client.
ssl-cipher-suite: Returns the cipher suite in the TLS connection.

format

The optional xs:string that specifies the order of the DN components when detail is ssl-client-subject or ssl-client-issuer.

ldap: Arranges the RDNs of the DNs from right-to-left separated by commas: CN=John, C=us
x500: Arranges the RDNs of the DNs from left-to-right and separated by commas: C=us, CN=John
ldap-strict: Arranges the RDNs of the DNs in the same way as the ldap format, but strictly complies with the LDAP standard. The output does not include a space after the comma separator: CN=John,C=us
x500-strict: Arranges the RDNs of the DNs in the same way as the x500 format, but strictly complies with the LDAP standard. The output does not include a space after the comma separator: C=us,CN=John

If not specified, the format is separated by forward slashes: /C=us/CN=John

Guidelines

The dp:auth-info() function returns client authentication information.

For HTTP basic authentication, the credentials are transcoded from the character set defined for the service to UTF-8. Define the character set for credentials with the credential-charset or listen-on command.

The extension passes all arguments as XPath expressions.

Results

An xs:string that contains the authentication credentials.

If dp:auth-info('ssl-client-subject'): /C=US/ST=MA/L=Cambridge/O=DataPower/CN=Alice
If dp:auth-info('ssl-client-subject', 'ldap'): CN=Alice, O=DataPower, L=Cambridge, ST=MA, C=US
If dp:auth-info('ssl-client-subject', 'x500'): C=US, ST=MA, L=Cambridge, O=DataPower, CN=Alice
If dp:auth-info('ssl-client-subject', 'ldap-strict'): CN=Alice,O=DataPower,L=Cambridge,ST=MA,C=US
If dp:auth-info('ssl-client-subject', 'x500-strict'): C=US,ST=MA,L=Cambridge,O=DataPower,CN=Alice

Example

Retrieve the client's BasicAuth name.

...
<xsl:value-of select="dp:auth-info('basic-auth-name')"/>
...

Retrieve the cipher suite that is used in a secure connection.

...
<xsl:value-of select="dp:auth-info('ssl-cipher-suite')"/>
...