【发布时间】：2023-02-17 16:17:06
【问题描述】：
I want to implement client certificate authentication in my web api. I followed the MSDN documentation and tried other examples on the web. Unfortunately I can't get it to work.
The page can be reached with the certificate mode "noCertificate". But when I implement the following line I get this error.
opt.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
Here is my code. Maybe someone can spot my mistake. Actually, I would expect the browser to open the certificate selection window.
Programm.cs
using Microsoft.AspNetCore.Authentication.Certificate;
using Microsoft.AspNetCore.Server.Kestrel.Https;
using System.Security.Cryptography.X509Certificates;
using TestClientCert.Validator;
var builder = WebApplication.CreateBuilder(args);
builder.WebHost.UseKestrel(options =>
{
options.ConfigureHttpsDefaults(opt =>
{
opt.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
});
});
// Add services to the container.
builder.Services.AddControllers();
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();
builder.Services.AddTransient<MyCertificateValidationService>();
builder.Services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme)
.AddCertificate(options =>
{
options.RevocationMode = X509RevocationMode.NoCheck;
options.AllowedCertificateTypes = CertificateTypes.All;
options.Events = new CertificateAuthenticationEvents
{
OnCertificateValidated = context =>
{
var validationService = context.HttpContext.RequestServices.GetService<MyCertificateValidationService>();
if (validationService.ValidateCertificate(context.ClientCertificate))
{
context.Success();
}
else
{
context.Fail("invalid cert");
}
return Task.CompletedTask;
},
OnAuthenticationFailed = context =>
{
context.Fail("invalid cert");
return Task.CompletedTask;
}
};
});
builder.Services.AddAuthorization();
var app = builder.Build();
// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
app.UseSwagger();
app.UseSwaggerUI();
}
app.UseHttpsRedirection();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();
app.Run();
MyCertificateValidationService.cs
using System.Security.Cryptography.X509Certificates;
namespace TestClientCert.Validator
{
public class MyCertificateValidationService
{
public bool ValidateCertificate(X509Certificate2 clientCertificate)
{
string[] allowedThumbprints = { "B30D884E44EC218513CF2A5CA246F0AFA1DD8E9B", "6ECB2E563B9129C72215EE00686CAA95FBC5BEC6" };
if (allowedThumbprints.Contains(clientCertificate.Thumbprint))
{
return true;
}
return false;
}
}
}
HomeController.cs
using Microsoft.AspNetCore.Mvc;
namespace TestClientCert.Controllers
{
[ApiController]
[Route("[controller]")]
public class HomeController : Controller
{
[HttpGet]
public string Get() => "Welcome to Narnia";
}
}
标签： c# asp.net-core asp.net-web-api client-certificates mtls