Azure / Azure/azure-rest-api-specs

Add support for cert-based authentication using EC certs (ES 256, ES384)

Open
#6,637 5 comments 0 reactions 0 assignees View on GitHub
AAD Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
6k
Avg merge
2d 22h
Merged PRs (30d)
444

Description

**The issue is copied from https://github.com/Azure/azure-sdk-for-net/issues/6521

Currently AAD only supports certificate authentication using RSA certs (eg RSA 2048). There is no support for authenticating with EC certs (eg ECDSA P-256 and P-384). This is documented here:

https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials

Which effectively states that "only JWT alg RS256 is supported". This is confirmed by the ClientAssertionCertificate code here:
https://github.com/Azure/azure-sdk-for-net/blob/master/src/SdkCommon/Auth/Az.Auth/Az.Authentication/ClientAssertionCertificate.cs#L46

(Right now if you try using an EC cert with ClientAssertionCertificate, it fails with a `NullReferenceException`).

Elliptic curve based certs provide stronger security with less overhead - this generally improves code efficiency, and is particularly important for mobile devices. IMO AAD should support authentication using "better" certs - eg the ES384 alg in the JWT standard:
https://tools.ietf.org/html/rfc7518#page-6

Companies that are using next-gen approaches for security (authenticate with certs, use ECC certs) shouldn't have to generate separate RSA certs purely to authenticate with AAD.

Obviously this would need to be added in the client and the server. The azure-sdk-for-net repo only covers the client, could someone at Microsoft please add the request for server support for ES256 and ES384 JWT signatures?

Contributor guide

Open the contributing guide

Research direction

Start with the referenced ClientAssertionCertificate.cs implementation and the copied Azure SDK issue at Azure/azure-sdk-for-net#6521. Check how the azure-rest-api-specs repository represents the affected authentication behavior and whether server support is represented here. Done would require an agreed client and server path for ES256 and ES384 certificate-based authentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authentication, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.