Azure B2C 自定义策略 Rest API 客户端证书

Question

I have a custom policy that I created to call a rest api to do some custom user verification. I have that working, I log into my site via the B2C custom policy and my rest api is called like it should. Now that I have it working, I would like to secure it so that only the B2C custom policy is able to make that call to that particular controller/method. I've read the documentation on securing the rest api ( Secure your API Connector ), I created a self-signed certificate, uploaded the certificate to the IEF policy and updated my rest api technical profile. What I can't figure out is how to add/use the certificate (.pxf) inside my Blazor server application. All the documentation I've found so far is all Azure B2C, not how to tie all this together? Any guidance would be greatly appreciated.

My appsettings.json

"AzureAdB2C": {
    "Instance": "https://my-tenant.b2clogin.com",
    "ClientId": "[guid]",
    "CallbackPath": "/signin-oidc",
    "Domain": "my-tenant.onmicrosoft.com",
    "SignedOutCallbackPath": "/signout",
    "SignUpSignInPolicyId": "B2C_1A_custom_signup_signin",
    "ResetPasswordPolicyId": "B2C_1_password_reset",
    "EditProfilePolicyId": "",
    "ClientSecret": "my-secret-key"
}

My Configure Services

public void ConfigureServices(IServiceCollection services)
    {
        services.AddRazorPages();
        services.AddServerSideBlazor();
        services.AddSingleton<WeatherForecastService>();

        services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAdB2C"));
        
        services.AddControllersWithViews().AddMicrosoftIdentityUI();

        services.AddServerSideBlazor().AddMicrosoftIdentityConsentHandler();
    }

My custom claim provider

<ClaimsProvider>
  <DisplayName>REST APIs</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="REST-GetProfile">
      <DisplayName>Get user extended profile Azure Function web hook</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <Metadata>
        <!-- Set the ServiceUrl with your own REST API endpoint -->
        <Item Key="ServiceUrl">https://my.azurewebsites.com/api/Validate</Item>
        <Item Key="SendClaimsIn">Body</Item>
        <!-- Set AuthenticationType to Basic or ClientCertificate in production environments -->
        <Item Key="AuthenticationType">ClientCertificate</Item>
        <!-- REMOVE the following line in production environments -->
        <Item Key="AllowInsecureAuthInProduction">false</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="ClientCertificate" StorageReferenceId="B2C_1A_RestApiClientCertificate" />
      </CryptographicKeys>
      <InputClaims>
        <!-- Claims sent to your REST API -->
        <InputClaim ClaimTypeReferenceId="objectId" />
        <InputClaim ClaimTypeReferenceId="signInNames.emailAddress" PartnerClaimType="email"/>
        <InputClaim ClaimTypeReferenceId="userLanguage" PartnerClaimType="lang" DefaultValue="{Culture:LCID}" AlwaysUseDefaultValue="true" />
      </InputClaims>
      <OutputClaims>
        <!-- Claims parsed from your REST API -->
        <OutputClaim ClaimTypeReferenceId="IsValid" />
      </OutputClaims>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

I've made a little bit of progress. I created a Certification Validation Service:

public class MyCertificateValidationService
{
    public bool ValidateCertificate(X509Certificate2 clientCertificate)
    {
        var cert = new X509Certificate2( Path.Combine( @"..\MyCertificate.pfx" ), "[password]");
        Console.WriteLine($"cert.Thumbprint: {cert.Thumbprint}{Environment.NewLine}clientCertificate.Thumbprint");
        if (clientCertificate.Thumbprint == cert.Thumbprint)
        {
            return true;
        }

        return false;
    }
}

And updated my ConfigureServices:

    public void ConfigureServices( IServiceCollection services )
    {
        services.AddRazorPages();
        services.AddServerSideBlazor();
        services.AddSingleton<WeatherForecastService>();

        services.AddAuthentication( OpenIdConnectDefaults.AuthenticationScheme )
            .AddMicrosoftIdentityWebApp( Configuration.GetSection( "AzureAdB2C" ) );

        services.AddAuthentication( CertificateAuthenticationDefaults.AuthenticationScheme )
            .AddCertificate( options =>
             {
                 options.AllowedCertificateTypes = CertificateTypes.All;
                 options.Events = new CertificateAuthenticationEvents
                 {
                     OnCertificateValidated = context =>
                     {
                         var validationService = context.HttpContext.RequestServices
                             .GetRequiredService<MyCertificateValidationService>();

                         if( validationService.ValidateCertificate( context.ClientCertificate ) )
                         {
                             var claims = new[]
                             {
                                new Claim(
                                    ClaimTypes.NameIdentifier,
                                    context.ClientCertificate.Subject,
                                    ClaimValueTypes.String,
                                    context.Options.ClaimsIssuer),
                                new Claim(ClaimTypes.Name,
                                    context.ClientCertificate.Subject,
                                    ClaimValueTypes.String,
                                    context.Options.ClaimsIssuer)
                             };

                             context.Principal = new ClaimsPrincipal(
                                 new ClaimsIdentity( claims, context.Scheme.Name ) );
                             context.Success();
                         }

                         return Task.CompletedTask;
                     }
                 };
             } )
            // Adding an ICertificateValidationCache results in certificate auth caching the results.
            // The default implementation uses a memory cache.
            .AddCertificateCache();

        services.AddControllersWithViews().AddMicrosoftIdentityUI();

        services.AddServerSideBlazor().AddMicrosoftIdentityConsentHandler();
    }

Now when I try and call my rest api, I get the following error:

AADB2C90028: Client certificate specified for 'REST-GetProfile' is invalid. Check that the certificate is correct, contains a private key and that access has been granted by the resource. Correlation ID: [guid] Timestamp: 2021-05-13 14:10:15Z

Any ideas of things I could check or try?