Take the 2-minute tour ×  I'd like to set up an OpenID provider
for our group, which we can use to log in to internal and
external OpenID-aware services (e.g. stackoverflow.com).  Our
users all have X.509 certificates issued by our CA, so I think
the ideal solution would use that to authenticate them (i.e. the
provider shouldn't ask for a password). Maybe Apache
FakeBasicAuth would work to extract the username from the SSL
connection's certificate?  What would be the best software to
use? Open Source preferred.  share|improve this question  2
Answers 2  up vote 1 down vote accepted  OK, I got this working
using:  In the Apache configuration, I did this (note: didn't
use FakeBasicAuth in the end):  SSLCACertificateFile
/.../myOrgCA.pem SSLVerifyClient require SSLVerifyDepth  1
SSLOptions      +StdEnvVars  Edit action_default() to redirect
the user to the https address if accessed over plain http. The
plain http address is the one you publish in your <link
rel="openid.server">.  Change getLoggedInUser() to extr