Repository navigation
Create Native Test Solution for Certificate Authentication #4609
Description
Problem
There is currently no native cross-platform, CI independent mechanism to test Certificate Authentication in Invoke-WebRequest and Invoke-RestMethod.
Proposal
Create a docker container to house a minimal aspnetcore app to validate Client Certificate presence in calls made by Invoke-WebRequest and Invoke-RestMethod. The docker container will need a self-signed certificate, SSL/TLS configuration, and be Linux based (debian jessie?). The aspnetcore app will need to, at minimum, echo whether a Client Certificate was presented or not and possibly include details about the Client Certificate. The entire solution will need to work in both AppVeyor and Travis CI and be as CI agnostic as possible.
see #4546
Activity
markekraus commentedon Aug 17, 2017
Travis Plunk (@TravisEz13) We can work on the solution through this issue.
markekraus commentedon Aug 18, 2017
Travis Plunk (@TravisEz13) I think I'm on to something. the built-in Kestrel server for ASP.NET core supports client certificates. I'm working on an small app that returns the client certificate details. The idea is that the test calls
dotnet runon the project in aStart-Job, does the tests, then tears it down the job. I actually have a prototype of this working in a web browser, butInvoke-WebRequestandInvoke-RestMethodcan't find a common algorithm with Kestrel. It looks like I need to enable TLS in Kestrel, but the examples I have found for doing so no longer work in 2.0.Somewhat Functional
Now With Docker
[Feature] Add Tests for Web Cmdlet Certificate Authentication
iSazonov commentedon Aug 20, 2017
I believe we should use natively supported web server - Apache on CI Travis and IIS on CI AppVeyor. It requires more effort, but it makes our tests more predictable. I do not see the pressing need to make sure to use a port server.
2 remaining items
TravisEz13 commentedon Aug 21, 2017
Mark Kraus (@markekraus) It seems worth investigating. I would start with feature tests and if there are any issues with the approach the impact would not be blocking. Then if it proves a good solution, we can try broadening the approach to other tests.
markekraus commentedon Aug 21, 2017
Travis Plunk (@TravisEz13) How should I approach PR's for this? There are a bunch of feature
it's for both cmdlets, how should I break them up, if at all?[Feature] Add Tests for Web Cmdlet Certificate Authentication
[Feature] Add Tests for Web Cmdlet Certificate Authentication
TravisEz13 commentedon Aug 21, 2017
Mark Kraus (@markekraus) Let's finish the current PR, then think about this if you don't mind?
markekraus commentedon Aug 21, 2017
Travis Plunk (@TravisEz13) sure thing!
markekraus commentedon Aug 22, 2017
in #4622 it was discovered that Client Certificate Authentication is still unavailable in macOS due to a compatibility issue between CoreFX and and macOS's implementation of curl.
dotnet/corefx#19718
SteveL-MSFT commentedon Aug 28, 2017
cc James Truher (@JamesWTruher)
Add test WebListener module and tests for Web Cmdlet Certificate Auth…
Add test WebListener module and tests for Web Cmdlet Certificate Auth…
Add test WebListener module and tests for Web Cmdlet Certificate Auth…