HttpContext.RequestServices.GetService<>() 返回的证书验证服务为 null

Question

I am attempting to follow Microsoft Documentation and other blogs that demonstrate Certificate Authentication in ASP.NET Core. The call RequestServices.GetService() is returning null. I added the null check on the validationService variable for a sanity check that it was the null reference.

public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme).AddCertificate(options =>
        {
            options.RevocationMode = System.Security.Cryptography.X509Certificates.X509RevocationMode.NoCheck;
            options.Events = new CertificateAuthenticationEvents
            {
                OnCertificateValidated = context =>
                {
                    var validationService = context.HttpContext.RequestServices.GetService<MyCertificateValidationService>();

                    if (validationService == null)
                    {
                        throw new NullReferenceException("Validation Service returned by GetService<MyCertificateValidationService>() is null");
                    }

                    if (validationService.ValidateCertificate(context?.ClientCertificate))
                    {
                        var claims = new[]
                    {
                        new Claim(
                            ClaimTypes.NameIdentifier,
                            context.ClientCertificate.Subject,
                            ClaimValueTypes.String,
                            context.Options.ClaimsIssuer),
                        new Claim(
                            ClaimTypes.Name,
                            context.ClientCertificate.Subject,
                            ClaimValueTypes.String,
                            context.Options.ClaimsIssuer)
                    };

                        context.Principal = new ClaimsPrincipal(new ClaimsIdentity(claims, context.Scheme.Name));
                        context.Success();
                    }

                    return Task.CompletedTask;
                }
            };
        });

        services.AddControllers();

        services.AddMvc()
            .AddXmlSerializerFormatters();
    }

The validation service class:

public class MyCertificateValidationService
{
    public bool ValidateCertificate(X509Certificate2 clientCertificate)
    {
        bool valid = false;

        var cert = new X509Certificate2(Path.Combine("Test.crt"), ")F@4R9df3s75(5g0");

        if (clientCertificate.Thumbprint == cert.Thumbprint)
        {
            valid = true;
        }

        return valid;
    }
}

Here is the Configure method in Startup:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env, ILoggerFactory loggerFactory)
    {
        app.UseCertificateForwarding();
        app.UseAuthentication();

        loggerFactory.AddSerilog();

        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/error");
        }

        app.UseMiddleware<SerilogMiddleware>();

        app.UseMiddleware<AuthenticationMiddleware>();
        
        app.UseRouting();

        app.UseEndpoints(endPoints =>
        {
            endPoints.MapControllers();
        });
    }

Answer 1

As king king says, if you want to use custom certificate handler service, you should register it firstly and then use it like below:

Notice: The document has mentioned that you could also used ICertificateValidationService , you also need to build this service by yourself and register it as service, if you want to get it from context.HttpContext.RequestServices.GetService method.

public void ConfigureServices(IServiceCollection services)
    {
         services.AddSingleton<MyCertificateValidationService>();
services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme).AddCertificate(options =>
                {
                    options.RevocationMode = System.Security.Cryptography.X509Certificates.X509RevocationMode.NoCheck;
                    options.Events = new CertificateAuthenticationEvents
                    {
                        OnCertificateValidated = context =>
                        {
                            var validationService = context.HttpContext.RequestServices.GetService<MyCertificateValidationService>();
        
                            if (validationService == null)
                            {
                                throw new NullReferenceException("Validation Service returned by GetService<MyCertificateValidationService>() is null");
                            }
        
                            if (validationService.ValidateCertificate(context?.ClientCertificate))
                            {
                                var claims = new[]
                            {
                                new Claim(
                                    ClaimTypes.NameIdentifier,
                                    context.ClientCertificate.Subject,
                                    ClaimValueTypes.String,
                                    context.Options.ClaimsIssuer),
                                new Claim(
                                    ClaimTypes.Name,
                                    context.ClientCertificate.Subject,
                                    ClaimValueTypes.String,
                                    context.Options.ClaimsIssuer)
                            };
        
                                context.Principal = new ClaimsPrincipal(new ClaimsIdentity(claims, context.Scheme.Name));
                                context.Success();
                            }
        
                            return Task.CompletedTask;
                        }
                    };
                });
        
                services.AddControllers();
        
                services.AddMvc()
                    .AddXmlSerializerFormatters();
            }

Also I suggest you could refer to this github demo to know how it works with client certificate auth.