client certificate handling (#18)

* support multiple cert headers
* support x509 distinguished name parsing
* remove cert header defaults

src/Identity.Accounts/Models/CertificateSubjectDetail.cs

@@ -1,5 +1,5 @@
-// Copyright 2020 Carnegie Mellon University. 
-// Released under a MIT (SEI) license. See LICENSE.md in the project root. 
+// Copyright 2020 Carnegie Mellon University.
+// Released under a MIT (SEI) license. See LICENSE.md in the project root.
 
 using System;
 using System.Collections.Generic;
@@ -21,25 +21,44 @@ public class CertificateSubjectDetail
 
         // expecting ldap v3 distinguished names. https://tools.ietf.org/html/rfc2253
         // That's what nginx 1.11+ passes
+        // now supporting x500 format, with it's inverse ordering and looser char constraints.
         public CertificateSubjectDetail(string subjectDN)
         {
             if (string.IsNullOrEmpty(subjectDN))
                 return;
 
+            char[] delimiters = new char[] {',', '+', ';'};
             var rdns = new List<string>();
             int i = 0, j = 0;
             char[] chars = subjectDN.ToCharArray();
             char last = '_';
+            bool quoted = false;
+            bool escaped = false;
+            bool x500_ordering = subjectDN.IndexOf("O=") < subjectDN.LastIndexOf("OU=");
+
             for (i = 0; i < chars.Length; i++)
             {
-                if ((chars[i] == ',' || chars[i] == '+') && last != '\\')
+                // close-quote
+                if (chars[i] == '"' && quoted)
+                    quoted = false;
+
+                // open-quote
+                if (chars[i] == '"' && last == '=')
+                    quoted = true;
+
+                // escaped
+                escaped = chars[i] != '\\' && last == '\\';
+
+                if (!quoted && !escaped && delimiters.Contains(chars[i]))
                 {
-                    rdns.Add(subjectDN.Substring(j, i-j));
+                    ParseMultiValueRDN(rdns, subjectDN.Substring(j, i-j).Trim());
                     j = i+1;
                 }
+
                 last = chars[i];
             }
-            rdns.Add(subjectDN.Substring(j));
+            // last value
+            ParseMultiValueRDN(rdns, subjectDN.Substring(j).Trim());
 
             this.Subject = subjectDN;
             this.IsAffiliate = Regex.IsMatch(subjectDN, "affiliate|contractor", RegexOptions.IgnoreCase);
@@ -49,7 +68,7 @@ public CertificateSubjectDetail(string subjectDN)
 
             //if no externalid, parse from CN, dod-style
             if (String.IsNullOrEmpty(ExternalId)
-                && Int64.TryParse(nameParts.Last(), out long id))
+                && Int64.TryParse(nameParts.Last(), out _))
             {
                 this.ExternalId = nameParts.Last();
             }
@@ -66,12 +85,16 @@ public CertificateSubjectDetail(string subjectDN)
             var ou = rdns.Where(x => x.StartsWith("OU=")).Select(x => x.Substring(3));
             var o = rdns.Where(x => x.StartsWith("O=")).Select(x => x.Substring(2));
             bool hasContext = false;
-            foreach (string s in ou) hasContext |= ExternalId.Contains(s);
-            foreach (string s in o) hasContext |= ExternalId.Contains(s);
+            foreach (string s in ou.Union(o)) hasContext |= ExternalId.Contains(s);
+            // foreach (string s in o) hasContext |= ExternalId.Contains(s);
             if (!hasContext)
             {
+                string suffix = x500_ordering
+                    ? ou.FirstOrDefault() ?? o.FirstOrDefault()
+                    : ou.LastOrDefault() ?? o.LastOrDefault()
+                ;
                 DeprecatedExternalId = ExternalId;
-                ExternalId += "." + ou.LastOrDefault() ?? o.LastOrDefault();
+                ExternalId += "." + suffix;
             }
 
             DisplayName = (nameParts.Length > 1) // assume dod-style
@@ -87,5 +110,16 @@ public CertificateSubjectDetail(string subjectDN)
             this.DisplayName = String.Join(" ", nameParts).ToTitle();
             this.UserName = this.DisplayName.ToAccountSlug();
         }
+
+        private void ParseMultiValueRDN(List<string> list, string rdn)
+        {
+            int e = rdn.IndexOf('=');
+            string key = rdn.Substring(0, e);
+            string val = rdn.Substring(e+1).Replace("\"", "");
+            string[] multi = val.Split('+');
+            list.Add($"{key}={multi[0].Trim()}");
+            foreach (string p in multi.Skip(1))
+                list.Add(p);
+        }
     }
 }

src/Identity.Accounts/Options/AuthenticationOptions.cs

@@ -29,10 +29,10 @@ public class AuthenticationOptions
         public string SigningCertificate { get; set; }
         public string SigningCertificatePassword { get; set; }
 
-        public string ClientCertHeader { get; set; } = "X-ARR-ClientCert";
-        public string ClientCertSubjectHeader { get; set; } = "ssl-client-subject-dn";
-        public string ClientCertIssuerHeader { get; set; } = "ssl-client-issuer-dn";
-        public string ClientCertVerifyHeader { get; set; } = "ssl-client-verify";
-        public string ClientCertSerialHeader { get; set; } = "ssl-client-serial";
+        public string ClientCertHeader { get; set; }
+        public string[] ClientCertSubjectHeaders { get; set; } = new string[] {};
+        public string[] ClientCertIssuerHeaders { get; set; } = new string[] {};
+        public string[] ClientCertSerialHeaders { get; set; } = new string[] {};
+        public string[] ClientCertVerifyHeaders { get; set; } = new string[] {};
     }
 }

src/IdentityServer/Api/AccountController.cs

@@ -225,15 +225,13 @@ private string ResolveRecipients(Account[] list, string[] to)
         }
 
         [HttpGet("api/stats")]
-        [AllowAnonymous]
         [ProducesResponseType(typeof(AccountStats), 200)]
         public async Task<IActionResult> GetStats([FromQuery] DateTime since)
         {
             return Ok(await _svc.GetStats(since));
         }
 
         [HttpGet("api/version")]
-        [AllowAnonymous]
         [ProducesResponseType(typeof(string), 200)]
         public IActionResult Version()
         {

src/IdentityServer/Api/ProfileController.cs

@@ -176,12 +176,12 @@ public async Task<IActionResult> GetTokenSummary()
 
                 CurrentCertificateIssuer = Request.GetCertificateIssuer(
                     _options.Authentication.ClientCertHeader,
-                    _options.Authentication.ClientCertIssuerHeader
+                    _options.Authentication.ClientCertIssuerHeaders
                 ),
 
                 CurrentCertificateSubject = Request.GetCertificateSubject(
                     _options.Authentication.ClientCertHeader,
-                    _options.Authentication.ClientCertSubjectHeader
+                    _options.Authentication.ClientCertSubjectHeaders
                 )
             });
 
@@ -194,7 +194,7 @@ public IActionResult GetCurrentCertSubject()
         {
             string subject = Request.GetCertificateSubject(
                 _options.Authentication.ClientCertHeader,
-                _options.Authentication.ClientCertSubjectHeader
+                _options.Authentication.ClientCertSubjectHeaders
             );
             return Ok(subject);
         }
@@ -214,8 +214,7 @@ public async Task<IActionResult> SetCurrentCertSubject()
             {
                 if (Request.HasValidatedSubject(
                     _options.Authentication.ClientCertHeader,
-                    _options.Authentication.ClientCertSubjectHeader,
-                    _options.Authentication.ClientCertVerifyHeader,
+                    _options.Authentication.ClientCertSubjectHeaders,
                     out subject)
                 ){
                     await _svc.AddAccountValidatedSubject(User.GetSubjectId(), subject);

src/IdentityServer/Extensions/HttpRequestExtensions.cs

@@ -18,7 +18,7 @@ public static bool HasCertificate(
             out X509Certificate2 cert
         ){
             cert = request.HttpContext.Connection.ClientCertificate;
-            if (cert == null)
+            if (cert == null && !string.IsNullOrEmpty(header))
             {
                 string xcert = request.Headers[header];
                 if (!String.IsNullOrEmpty(xcert))
@@ -32,41 +32,47 @@ out X509Certificate2 cert
         public static bool HasValidatedSubject(
             this HttpRequest request,
             string certHeader,
-            string subjectHeader,
-            string verifyHeader,
+            string[] subjectHeaders,
             out string subject
         ){
-            subject = request.GetCertificateSubject(certHeader, subjectHeader);
-            string verify = request.Headers[verifyHeader];
-            return !string.IsNullOrEmpty(subject) && verify.StartsWith("success",StringComparison.OrdinalIgnoreCase);
+            subject = request.GetCertificateSubject(certHeader, subjectHeaders);
+            return string.IsNullOrEmpty(subject).Equals(false);
         }
 
         public static string GetCertificateSubject(
             this HttpRequest request,
             string certHeader,
-            string subjectHeader
+            string[] headers
         ){
             if (request.HasCertificate(certHeader, out X509Certificate2 certificate2))
                 return certificate2.Subject;
 
-            if (string.IsNullOrEmpty(subjectHeader))
-                return "";
-
-            return request.Headers[subjectHeader];
+            return request.GetFirstHeaderValue(headers);
         }
 
         public static string GetCertificateIssuer(
             this HttpRequest request,
             string certHeader,
-            string issuerHeader
+            string[] headers
         ){
             if (request.HasCertificate(certHeader, out X509Certificate2 certificate2))
                 return certificate2.Issuer;
 
-            if (string.IsNullOrEmpty(issuerHeader))
-                return "";
+            return request.GetFirstHeaderValue(headers);
+        }
+
+        public static string GetFirstHeaderValue(
+            this HttpRequest request,
+            string[] headers
+        ){
+            foreach(string header in headers)
+            {
+                string value = request.Headers[header];
+                if (string.IsNullOrEmpty(value).Equals(false))
+                    return value;
+            }
 
-            return request.Headers[issuerHeader];
+            return "";
         }
 
         public static bool IsPrivileged(this ClaimsPrincipal user)

src/IdentityServer/Features/Account/Account/Login.cs

@@ -28,6 +28,7 @@ public class LoginViewModel : LoginModel
         public bool MSIE { get; set; }
         public string CertificateSubject { get; set; }
         public string CertificateIssuer { get; set; }
+        public string CertificateVerification { get; set; }
     }
 
 }

src/IdentityServer/Features/Account/Account/Login.cshtml

@@ -31,19 +31,38 @@
 
                 @if (String.IsNullOrEmpty(Model.CertificateSubject))
                 {
-                    <p>
-                        If expecting to use a certificate, you should
-                        <strong>already</strong> have been prompted by your
-                        browser to enter the PIN. If that is not the
-                        case, please refer to
-                        <a asp-action="trouble">troubleshooting</a>.
-                    </p>
+                    @if(String.IsNullOrEmpty(Model.CertificateVerification))
+                    {
+                        <p>
+                            If expecting to use a certificate, you should
+                            <strong>already</strong> have been prompted by your
+                            browser to enter the PIN. If that is not the
+                            case, please refer to
+                            <a asp-action="trouble">troubleshooting</a>.
+                        </p>
+                    }
+                    else
+                    {
+                        <p aria-label="client certificate verification">
+                            <span>Certificate Status:</span>
+                            <em>@Model.CertificateVerification</em>
+                        </p>
+                    }
                 }
                 else
                 {
-                    <p aria-label="client certificate subject">
-                        <em>@Model.CertificateSubject</em><br/>
-                    </p>
+                    <table class="table my-2 text-left" aria-label="client certificate subject">
+                        <tbody>
+                            <tr>
+                                <th>Subject</th>
+                                <td><small>@Model.CertificateSubject</small></td>
+                            </tr>
+                            <tr>
+                                <th>Issuer</th>
+                                <td><small>@Model.CertificateIssuer</small></td>
+                            </tr>
+                        </tbody>
+                    </table>
                     <p>
                         <form asp-route="Login">
                             <input id="cert-ReturnUrl" type="hidden" asp-for="ReturnUrl"/>

src/IdentityServer/Features/Account/AccountController.cs

@@ -91,8 +91,7 @@ public async Task<IActionResult> Login(string returnUrl)
 
                 if (Request.HasValidatedSubject(
                     _options.Authentication.ClientCertHeader,
-                    _options.Authentication.ClientCertSubjectHeader,
-                    _options.Authentication.ClientCertVerifyHeader,
+                    _options.Authentication.ClientCertSubjectHeaders,
                     out string subject)
                 ){
                     return await LoginWithValidatedSubject(subject, returnUrl);
@@ -126,8 +125,7 @@ public async Task<IActionResult> Login(LoginModel model)
 
                     if (Request.HasValidatedSubject(
                         _options.Authentication.ClientCertHeader,
-                        _options.Authentication.ClientCertSubjectHeader,
-                        _options.Authentication.ClientCertVerifyHeader,
+                        _options.Authentication.ClientCertSubjectHeaders,
                         out string subject)
                     ){
                         return await LoginWithValidatedSubject(subject, model.ReturnUrl);
@@ -807,15 +805,18 @@ public IActionResult Cert()
         {
             string result = Request.GetCertificateSubject(
                 _options.Authentication.ClientCertHeader,
-                _options.Authentication.ClientCertSubjectHeader
+                _options.Authentication.ClientCertSubjectHeaders
             );
 
             return Ok(result);
         }
 
         private async Task<IActionResult> Funregister()
         {
-            string tag = Request.Headers[_options.Authentication.ClientCertSubjectHeader];
+            string tag = Request.GetCertificateSubject(
+                _options.Authentication.ClientCertHeader,
+                _options.Authentication.ClientCertSubjectHeaders
+            );
             if (String.IsNullOrEmpty(tag))
                 tag = User?.FindFirstValue("sub");
             if (String.IsNullOrEmpty(tag))

src/IdentityServer/Features/Account/AccountViewService.cs

@@ -7,6 +7,7 @@
 using System.Text.RegularExpressions;
 using System.Threading.Tasks;
 using Identity.Accounts.Options;
+using IdentityServer.Extensions;
 using IdentityServer.Models;
 using IdentityServer.Options;
 using IdentityServer.Services;
@@ -68,6 +69,17 @@ public async Task<LoginViewModel> GetLoginView(LoginModel model, int lockedSecon
             await Task.Delay(0);
 
             var headers = _httpContextAccessor.HttpContext.Request.Headers;
+            string subject = _httpContextAccessor.HttpContext.Request.GetCertificateSubject(
+                _options.Authentication.ClientCertHeader,
+                _options.Authentication.ClientCertSubjectHeaders
+            );
+            string issuer = _httpContextAccessor.HttpContext.Request.GetCertificateIssuer(
+                _options.Authentication.ClientCertHeader,
+                _options.Authentication.ClientCertIssuerHeaders
+            );
+            string verification = _httpContextAccessor.HttpContext.Request.GetFirstHeaderValue(
+                _options.Authentication.ClientCertVerifyHeaders
+            );
 
             return new LoginViewModel() {
                 AllowRememberLogin = _options.Authentication.AllowRememberLogin,
@@ -79,8 +91,9 @@ public async Task<LoginViewModel> GetLoginView(LoginModel model, int lockedSecon
                 LockedSeconds = lockedSeconds,
                 ExternalSchemes = _authOptions.ExternalOidc.Select(e => e.Scheme).ToArray(),
                 MSIE = IsMSIE(headers[HeaderNames.UserAgent]),
-                CertificateSubject = headers[_options.Authentication.ClientCertSubjectHeader],
-                CertificateIssuer = headers[_options.Authentication.ClientCertIssuerHeader]
+                CertificateSubject = subject,
+                CertificateIssuer = issuer,
+                CertificateVerification = verification
             };
         }
         public async Task<PasswordViewModel> GetPasswordView(PasswordModel model, int lockedSeconds = 0)

src/IdentityServer/Features/Home/HomeController.cs

@@ -5,6 +5,7 @@
 using System.Security.Claims;
 using System.Threading.Tasks;
 using Identity.Accounts.Options;
+using IdentityServer.Extensions;
 using IdentityServer.Models;
 using IdentityServer.Options;
 using Microsoft.AspNetCore.Authorization;
@@ -56,7 +57,10 @@ public async Task<IActionResult> fUnregister()
             model.UserAgent = Request.Headers[HeaderNames.UserAgent];
             model.Subject = User?.FindFirstValue("sub") ?? Guid.NewGuid().ToString();
             model.Name = User?.Identity?.Name ?? "Ender Wiggin";
-            model.Certificate = Request.Headers[Options.Authentication.ClientCertSubjectHeader];
+            model.Certificate = Request.GetCertificateSubject(
+                Options.Authentication.ClientCertHeader,
+                Options.Authentication.ClientCertSubjectHeaders
+            );
             return View(model);
         }