api management client certificate authentication fails when values are not hard coded

Question

I am setting up client authentication on my API management component. I want clients to authenticate to my API management before they can access any APIs (so API management is server and API users are clients, NOT client authentication for backend services)

According to Microsoft, I can do this (https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates-for-clients). However, when I try to verify the thumbprint of my certificate against all trusted certificates I uploaded, it fails because of an invalid client certificate. I used the same policy code as Microsoft provides:

<choose>
    <when condition="@(context.Request.Certificate == null || !context.Deployment.Certificates.Any(c => c.Value.Thumbprint == context.Request.Certificate.Thumbprint))" >
        <return-response>
            <set-status code="403" reason="Invalid client certificate" />
        </return-response>
    </when>
</choose>

Now when I use a hard coded thumbprint to check, it succeeds:

<choose>
    <when condition="@(context.Request.Certificate == null || context.Request.Certificate.Thumbprint != "desired-thumbprint")" >
        <return-response>
            <set-status code="403" reason="Invalid client certificate" />
        </return-response>
    </when>
</choose>

I upload my client certificate to CA certificates. I cannot upload it in client certificates on API management because I do not have the private key. Only clients will have them and they will only send their public certificate so I can upload it into my API management instance when I trust them.

I think the policy to check all certificates might be wrong and it might be checking only the certificates from my client certificates. Is this correct? And if so, is it possible to check against all ca certificates I uploaded to API management?

Did you find the answer? I am doing same thing. But context.Request.Certificate is always null for me. I am using self signed certificate, I have uploaded to CA and Client Certificates. — Sappidireddy
@Sappidireddy I had to manually check on thumbprint and issuer in APIM policies. I could not successfully use Microsofts built-in client certificates because you need the private key that you do not have. Context.Request.Certificate is the certificate that is sent in the request from the client's side. If that is null, I presume something is wrong with the request and the certificate is not sent along with the request. — Lennart
Thank you!, I have posted my question in another thread. I am not getting any certificate in the request at all. I am not sure what I am doing wrong here stackoverflow.com/questions/57498215/… — Sappidireddy

Vitaliy Kurokhtin Vitaliy Kurokhtin · Accepted Answer · 2019-05-14T01:13:39

This only works if you upload it to client certificates. context.Deployment.Certificates is client certificates collection. I know that may seem counter-intuitive, and it is because context.Deployment.Certificates was not meant to be used exactly like that. It holds certificates APIM uses to authenticate itself to backend, thus need to provide private key.

If you do not have access to private keys of your client certificates and all of them are issued by a few CA/Root certificates, consider uploading CA/root certificates and use context.Request.Certificate.Verify to validate the chain.

api management client certificate authentication fails when values are not hard coded

1 Answers