Azure / Azure/azure-rest-api-specs
Add support for cert-based authentication using EC certs (ES 256, ES384)
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 6k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 444
Description
**The issue is copied from https://github.com/Azure/azure-sdk-for-net/issues/6521
Currently AAD only supports certificate authentication using RSA certs (eg RSA 2048). There is no support for authenticating with EC certs (eg ECDSA P-256 and P-384). This is documented here:
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials
Which effectively states that "only JWT alg RS256 is supported". This is confirmed by the ClientAssertionCertificate code here:
https://github.com/Azure/azure-sdk-for-net/blob/master/src/SdkCommon/Auth/Az.Auth/Az.Authentication/ClientAssertionCertificate.cs#L46
(Right now if you try using an EC cert with ClientAssertionCertificate, it fails with a `NullReferenceException`).
Elliptic curve based certs provide stronger security with less overhead - this generally improves code efficiency, and is particularly important for mobile devices. IMO AAD should support authentication using "better" certs - eg the ES384 alg in the JWT standard:
https://tools.ietf.org/html/rfc7518#page-6
Companies that are using next-gen approaches for security (authenticate with certs, use ECC certs) shouldn't have to generate separate RSA certs purely to authenticate with AAD.
Obviously this would need to be added in the client and the server. The azure-sdk-for-net repo only covers the client, could someone at Microsoft please add the request for server support for ES256 and ES384 JWT signatures?
Contributor guide
Research direction
Start with the referenced ClientAssertionCertificate.cs implementation and the copied Azure SDK issue at Azure/azure-sdk-for-net#6521. Check how the azure-rest-api-specs repository represents the affected authentication behavior and whether server support is represented here. Done would require an agreed client and server path for ES256 and ES384 certificate-based authentication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100