Repository navigation
Create Native Test Solution for Certificate Authentication #4609
Description
Activity
Travis Plunk (@TravisEz13) We can work on the solution through this issue.
Travis Plunk (@TravisEz13) I think I'm on to something. the built-in Kestrel server for ASP.NET core supports client certificates. I'm working on an small app that returns the client certificate details. The idea is that the test calls
dotnet runon the project in aStart-Job, does the tests, then tears it down the job. I actually have a prototype of this working in a web browser, butInvoke-WebRequestandInvoke-RestMethodcan't find a common algorithm with Kestrel. It looks like I need to enable TLS in Kestrel, but the examples I have found for doing so no longer work in 2.0.- added 7 commits that reference this issue
on Aug 19, 2017 I believe we should use natively supported web server - Apache on CI Travis and IIS on CI AppVeyor. It requires more effort, but it makes our tests more predictable. I do not see the pressing need to make sure to use a port server.
2 remaining items
Mark Kraus (@markekraus) It seems worth investigating. I would start with feature tests and if there are any issues with the approach the impact would not be blocking. Then if it proves a good solution, we can try broadening the approach to other tests.
Travis Plunk (@TravisEz13) How should I approach PR's for this? There are a bunch of feature
it's for both cmdlets, how should I break them up, if at all?Mark Kraus (@markekraus) Let's finish the current PR, then think about this if you don't mind?
Travis Plunk (@TravisEz13) sure thing!
in #4622 it was discovered that Client Certificate Authentication is still unavailable in macOS due to a compatibility issue between CoreFX and and macOS's implementation of curl.
dotnet/corefx#19718
- added a commit that references this issue
on Aug 31, 2017 - added a commit that references this issue
on Mar 3, 2018 - added a commit that references this issue
on Aug 6, 2026
Problem
There is currently no native cross-platform, CI independent mechanism to test Certificate Authentication in
Invoke-WebRequestandInvoke-RestMethod.Proposal
Create a docker container to house a minimal aspnetcore app to validate Client Certificate presence in calls made by
Invoke-WebRequestandInvoke-RestMethod. The docker container will need a self-signed certificate, SSL/TLS configuration, and be Linux based (debian jessie?). The aspnetcore app will need to, at minimum, echo whether a Client Certificate was presented or not and possibly include details about the Client Certificate. The entire solution will need to work in both AppVeyor and Travis CI and be as CI agnostic as possible.see #4546