dotnet / dotnet/aspnetcore

ANCM should forward the mapped Identity instead of the client certificate after IIS Client Cert Mapping Auth

Open
#42,896 15 comments 2 reactions 0 assignees View on GitHub
area-networking feature-iis
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

We are trying to use IIS Client Certificate mapping authentication together with ASP.NET Out of process handler. We see that ANCM module add MS-ASPNETCORE-CLIENTCERT header to pass the certificate blob to the core process, but this prevent the target asp.net core process to lose the mapped user context.

In other words: with IIS Client cert mapping(authmap.dll), IIS maps the certificate into a Windows identity. For the mapping to work IIS should forward the identity handle, not the certificate. The certificate no longer matters at that point, and aspnet core doesn’t know about or have the ability to take a client certificate and map it to a user. That doesn’t appear to be happening in ANCM, the IIS integration piece.

I know that after a successful certificate mapping , the User Context and the cached token is at the same place (HTTP Context), so hopefully it wont be a difficult change:
https://github.com/dotnet/aspnetcore/blob/52eff90fbcfca39b7eb58baad597df6a99a542b0/src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/forwardinghandler.cpp#L814

Thanks,
Mert

### Describe the solution you'd like

We would like to add IIS Certificate Mapping Authentication Integration to ANCM, via forwarding the identity handled instead of cert blob.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.