具有混合身份验证流程的客户端证书

Question

I'm developing a authentication/authorization server with IdentityServer3 and everything worked fine until now.

I'm trying to verify the hybrid flow client by a X509Certificate instead of the hashed secret in the samples.

My question is: How do I configure the client application to send the certificate for the authentication flow?

I saw in the source code for X509CertificateSecretParser.cs in order to get the client certificate, the owin environment variable "ssl.ClientCertificate" must have a value, but I cannot find where this value is set, even in the Microsoft.Owin source code.

I also try to use the certificate that I'm loading on the server as the SSL certificate for the client application, but this doesn't work too.

Code for setup the client secret:

[my client].ClientSecrets.Add(new Secret
{
    Value = Convert.ToBase64String(cert.Export(X509ContentType.Cert)),
    Type = Constants.SecretTypes.X509CertificateBase64
});

Code for setup de authentication of the client application:

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    Authority = ...,
    Scope = ...,
    ClientId = ...,
    RedirectUri = ...,
    ResponseType = "code id_token token",
    ClientSecret = "" , //What should I do with this?
    SignInAsAuthenticationType = "Cookies",
    Notifications = new OpenIdConnectAuthenticationNotifications
    {
        RedirectToIdentityProvider = ...,
        AuthorizationCodeReceived = ...
    }
});

Answer 1

a) You need to enable client certificates on IIS - our host has this commented out:

https://github.com/IdentityServer/IdentityServer3/blob/master/source/Host.Web/Web.config#L19

This will populate the OWIN SSL environment variable after a successful HTTPS handshake.

b) The OpenID Connect middleware will not automatically contact the token endpoint for you. You need to do that manually. This way you can configure the client cert to use. Here's a sample:

https://github.com/IdentityServer/IdentityServer3.Samples/blob/master/source/Clients/ClientCertificateConsoleClient/Program.cs#L26