Support for Base64UrlEncoded certificates. (#1923)

Author: brentschmaltz

.gitignore

@@ -229,6 +229,7 @@ ClientBin/
 *.pfx
 *.publishsettings
 orleans.codegen.cs
+!**/Certificates/*.pfx
 
 # Including strong name files can present a security risk
 # (https://github.com/github/gitignore/pull/2483#issue-259490424)

build/credscan-exclusion.json

@@ -4,7 +4,14 @@
       {
         "file": "ErrorCodes.cs",
         "_justification": "Constant contains the word Password as it is for the B2C password reset string value constant."
-    }
+      },
+      {
+        "file": "TestConstants.cs",
+        "_justification": "Constant contains a certificate that is not used for anything other than running tests and has a private key."
+      },
+      {
+        "file": "SelfSignedTestCert.pfx",
+        "_justification": "Cert used for running tests."
+      }
     ]
   }
-  

src/Microsoft.Identity.Web.Certificate/Base64EncodedCertificateLoader.cs

@@ -13,19 +13,43 @@ internal sealed class Base64EncodedCertificateLoader : ICredentialLoader
 
         public void LoadIfNeeded(CredentialDescription credentialDescription)
         {
-            credentialDescription.Certificate = LoadFromBase64Encoded(
-                            credentialDescription.Base64EncodedValue!,
-                            CertificateLoaderHelper.DetermineX509KeyStorageFlag(credentialDescription));
+            _ = credentialDescription ?? throw new ArgumentNullException(nameof(credentialDescription));
+
+            if (credentialDescription.Certificate != null)
+                return;
+
+            if (string.IsNullOrEmpty(credentialDescription.CertificatePassword))
+            {
+                credentialDescription.Certificate = LoadFromBase64Encoded(
+                                credentialDescription.Base64EncodedValue!,
+                                CertificateLoaderHelper.DetermineX509KeyStorageFlag(credentialDescription));
+            }
+            else
+            {
+                credentialDescription.Certificate = LoadFromBase64Encoded(
+                                credentialDescription.Base64EncodedValue!,
+                                credentialDescription.CertificatePassword!,
+                                CertificateLoaderHelper.DetermineX509KeyStorageFlag(credentialDescription));
+            }
+
             credentialDescription.CachedValue = credentialDescription.Certificate;
+
         }
 
         internal static X509Certificate2 LoadFromBase64Encoded(string certificateBase64, X509KeyStorageFlags x509KeyStorageFlags)
         {
-            byte[] decoded = Convert.FromBase64String(certificateBase64);
             return new X509Certificate2(
-                decoded,
+                Convert.FromBase64String(certificateBase64),
                 (string?)null,
                 x509KeyStorageFlags);
         }
+
+        internal static X509Certificate2 LoadFromBase64Encoded(string certificateBase64, string password, X509KeyStorageFlags x509KeyStorageFlags)
+        {
+            return new X509Certificate2(
+                Convert.FromBase64String(certificateBase64),
+                password,
+                x509KeyStorageFlags);
+        }
     }
 }

src/Microsoft.Identity.Web.Certificate/CertificateDescription.cs

@@ -82,6 +82,22 @@ public static CertificateDescription FromBase64Encoded(string base64EncodedValue
             };
         }
 
+        /// <summary>
+        /// Creates a certificate description from a Base64 encoded value.
+        /// </summary>
+        /// <param name="base64EncodedValue">Base64 encoded certificate value.</param>
+        /// <param name="password">The password to use when decoding the certificate.</param>
+        /// <returns>A certificate description.</returns>
+        public static CertificateDescription FromBase64Encoded(string base64EncodedValue, string password)
+        {
+            return new CertificateDescription
+            {
+                SourceType = CertificateSource.Base64Encoded,
+                Base64EncodedValue = base64EncodedValue,
+                CertificatePassword = password
+            };
+        }
+
         /// <summary>
         /// Creates a certificate description from path on disk.
         /// </summary>

src/Microsoft.Identity.Web.Certificate/FromPathCertificateLoader.cs

@@ -13,7 +13,7 @@ internal sealed class FromPathCertificateLoader : ICredentialLoader
         public void LoadIfNeeded(CredentialDescription credentialDescription)
         {
             credentialDescription.Certificate = LoadFromPath(
-                           credentialDescription.CertificateStorePath!,
+                           credentialDescription.CertificateDiskPath!,
                            credentialDescription.CertificatePassword!);
             credentialDescription.CachedValue = credentialDescription.Certificate;
         }

tests/Microsoft.Identity.Web.Test.Common/TestConstants.cs

@@ -121,6 +121,10 @@ public static class TestConstants
             y1NFZmB24rMoq8C+HPOpuVLzkwBr+qcCq7ry2326auogvVMGaxhHlwSLR4Q1OhRjKs8JctCk2+5Qs1NHfawa7jWHxdAK6cLm7Rv/c0ig2Jow7wRaI5ciAcEjX7
             m1t9gRT1mNeeluL4cZa6WyVXqXc6U2wfR5DY6GOMUubN5Nr1n8Czew8TPfab4OG37BuEMNmBpqoRrRgFnDzVtItOnhuFTa0=";
 
+        // This value is only for testing purposes. It is for a certificate that is not used for anything other than running tests and has a private key.
+        public const string CertificateX5cWithPrivateKey = @"MIIJWgIBAzCCCRYGCSqGSIb3DQEHAaCCCQcEggkDMIII/zCCBZAGCSqGSIb3DQEHAaCCBYEEggV9MIIFeTCCBXUGCyqGSIb3DQEMCgECoIIE7jCCBOowHAYKKoZIhvcNAQwBAzAOBAj6j5U8ayN7bAICB9AEggTIlqntAExN/iFpb3fUcR7DrLnGzNNfgRDzotFrjM3GshqpVKYZwnih+QV1+qoVX4efB9SIbUyXekru6BAS+xqSbkJh07xLR0TJvWc1sRlKeakoT5RmDxpeFko41rt3ZhitdLDn57OUF+tmiO8i/NGzLzDHWA/VUc2skpd9Dp8MRsfSst2/y3F+G/3LYJWK0haY44Lazc3fOM6Y9ULohfc4kcwCZhs3fH4CElOcpZ92euBebv17/b3Ykzeik4n38BHfPUfqC4wusfQnMDoCGoUw4+Praufhm8j6I8BQWIRkqP2cTay9dQ0jPe5qJ8i7fFvK4g37lSOwmk4zlzQX7jTYJmiyTJJ6B4xv2l7b30yyVmI0kJtldTtX324TLKCZMrzQRoUYtkBcBv7ZkQ4ilW0ct/iNsM/+uOu6QipN7rkZE7gVbem64sp8UTny9DK7oIlI21Ixt7WhesnGlbgdBQ65YAc7F/c9TyjdRb7B+lUP3aEViZCntbWelR5on0OlMslCgJek5pTf/YvEaQCUOM0K7Oht5A9pOV8xrKaOscGcpbphDkOehrc/tYNW52Wuvn6pggReZpLFKy+RvDbVoKT9JhJMgAVL3QUmyuc3T+LWTxNqLypt2DpnUrcQLXPnY9KA+YW98OSHDYANuvkJefa+/hmGt4Zc44XvCcjo4lZm0DTfDSQzJKvlVOxtIt0lB+GyNJW4natPhgjmthLoKL7T/7bldP/XaWrDS7ppUJh8qMD2KCpVPKAq0LHkkjIzok9ub6q3NCpdcVMxN8aEnG2kfOmObtuzdAn3/mVbfVnDtnVWgs7c6DR8t9HHav/OP2EYYzcOhYLCuStXG4MgSaWzij9x7RvbEFa9zzORzbTXh9x5NGE93RT1fzrgYo2Ub86ijMus4hy6nDUELASTQOnBZotnuMHX9ew/pUjGy4ZwkuMV6BCn+3dBsn91D1I9psWGwt1kzUdf2TsbyLEctA/SSrkSo4L5YP5AOAX+HQ1AMgg6vDoBp3PdEQi1pOyQCIj67JkPoHSRSyHNvb25yo0fWCT+FTcixlP1V7YeU2lNcGPQHF1MPmDOuLhQKzhIbkZzYRMbyGzgXsig6ITUxioZpURtPhfa3cIE7tjs/7NOmHrod8smLI+nZE5Q4h3FuGlQ8NtheI/KdGImsEst4KF9WI79aIMjgFHIfFSGOQfgp/788eegx63RN50ij5MZyGQroHKJbFPoymRYHW7ys/70tDuK++0eZ/bYQy3opxacg5R463ohW9SLGgWP9ri2Iqp58U+FnI6w6Zdos7ABrqr0TV1JxOq1Xz6xg4tmrrqQsTUHU7Fd+PX9kiR31e7LrVRPNMF8Y6zADvXG773hkqgSs3ZT60qO3UNpNrTe+S9TSKbr/bFLQqm8MSwB8BBHeLiqK94K6wqspQmJWa8tAWUowim57bQ5PypEZRrLx3wcj6KlpZYoKSqO6GW04VZ3JgHsufMhEypHZGrzOanoXPKUtZ2kMmqlnGy9NJ5DQLBLvpC9zasb+zfOl5o6dbfO0zUAfOjZ7lyoL0RoAHaBhS+StUDyL3MuV4g6Usahh/LSPq128YuvpXOmIfrQl2a5pm189i1hWQXMD80fHcHPxY8kHHXPn3qv0TLPMXQwEwYJKoZIhvcNAQkVMQYEBAEAAAAwXQYJKwYBBAGCNxEBMVAeTgBNAGkAYwByAG8AcwBvAGYAdAAgAFMAbwBmAHQAdwBhAHIAZQAgAEsAZQB5ACAAUwB0AG8AcgBhAGcAZQAgAFAAcgBvAHYAaQBkAGUAcjCCA2cGCSqGSIb3DQEHBqCCA1gwggNUAgEAMIIDTQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQMwDgQIBT/3QBXEYVcCAgfQgIIDIMQBNWZgQdQgJ4dYTyOQ2/wkKzxZ/vQOqqj1oOjonemD1d4USUHTRHfPJ5t7Rwd/8icTa6WCEC+cH8puJ3Xp+FTXZgI4iVb9y6glRamErii9gzaQfAB7gtLWJyQORlj2ick+M0J5vPu55pu1ozuu27/Ra3fgGWxNN5ak2XOLrcnAZ+sNvlUDjRHV2saZT76Ij7zZrLgXOGgqYvut4vaDiqzdYiuasAuwe98wLWNR7Xo9y1G7aCjtGZuiX3lOyRNIqvFvQirdIj3m+h2g8ksogpXr8SojH9pGE391wBLjjoV4tnvigcBoQBxiX9QjRdJkBKrilVq2+cCmV0NpNFa6SAq4NFAI41EMxk74gn/MmqzalSiM1mgyyFPzVstdo/46Uajfl4Nyp+Na3c5IUi8LZFxRtfvSkkN8CCxNkagtaaeMVEP953cam4x7KhjtOt57jBV4p7ba7ddmalcA9lzlzN/vwp8ZuzivEZLOQcGCFUslkJ1quyh8DHpHirzapL0hA/KnnJN4N0FGLmLDKDklXKb9LQha99Qd56kAZ4pbEP22AKfb+0KuBS+GvAwwQdduy+9V4QWsB1U1khVzZqiuGmCJXv32K2vYqOTiVZKrCXUmswfwWexhVccNm225q8G2XuWHRWUTcfs0fw93NKjQ/J0XPdO5f9dzd0InA9BfZ95g83zVvTwluiCJhTJjC9Rf/HrPX6JBN/HdBlKgq2ldYPiweZvl9/unOOH3uESU8Y+DZJCQj8HrVdjI/MJBkO6N4D3ioAd6PHmlRlM4Gp8J/B6o+8tQfnQyqQ5KiX7Sv7AspS6xPljWTQpw9sYmd13d+9eclKurdTwdv9+x88Ztc7nHsxd5zDlr5MsqEG0aNZY5yigjuJQpVIcdhhF6s75VTYDVs9LC9jAggYunFXNflX7vwrqCW+zudkg/s3ejOhfwvP1YeU6zkd3Kov7G/Q+TMvM/8WYzKVxss6fvKkBNQOzBfmtE8nPGL/kwZlJlqBLoSzd113YPWaUwXz5wpXx81fuGHzFmxyIdszRrEushrLM8fs7dRiEheMtTX5TjwV6xMDswHzAHBgUrDgMCGgQUpNPHCOYkkM0LdDOyfsYMvac8EccEFLsK+8VkSvQa4XMdBNQdPqFWKp/iAgIH0A==";
+        public const string CertificateX5cWithPrivateKeyPassword = "SelfSignedTestCert";
+
         public static string DecryptTokenCertificateDescriptionJson = "{" +
             "\"SourceType\": \"Base64Encoded\"," +
             $"\"Base64EncodedValue\": \"{CertificateX5c}\"," +

tests/Microsoft.Identity.Web.Test/Certificates/DefaultCertificateLoaderTests.cs

@@ -102,6 +102,32 @@ public void TestLoadAllCertificates(
             Assert.Null(certDescriptions.ElementAt(2).Certificate);
         }
 
+        [InlineData(CertificateSource.Base64Encoded, TestConstants.CertificateX5cWithPrivateKey, TestConstants.CertificateX5cWithPrivateKeyPassword)]
+        [InlineData(CertificateSource.Path, "Certificates\\SelfSignedTestCert.pfx", TestConstants.CertificateX5cWithPrivateKeyPassword)]
+        [Theory]
+        public void TestLoadCertificateWithPrivateKey(
+                    CertificateSource certificateSource,
+                    string container,
+                    string password)
+        {
+            CertificateDescription certificateDescription;
+
+            if (certificateSource == CertificateSource.Base64Encoded)
+            {
+                certificateDescription = CertificateDescription.FromBase64Encoded(container, password);
+            }
+            else
+            {
+                certificateDescription = CertificateDescription.FromPath(container, password);
+            }
+
+            DefaultCertificateLoader defaultCertificateLoader = new DefaultCertificateLoader();
+            defaultCertificateLoader.LoadIfNeeded(certificateDescription);
+
+            Assert.NotNull(certificateDescription.Certificate);
+            Assert.True(certificateDescription.Certificate.HasPrivateKey);
+        }
+
         private IEnumerable<CertificateDescription> CreateCertificateDescriptions(
             CertificateSource certificateSource,
             string container,

tests/Microsoft.Identity.Web.Test/Certificates/SelfSignedTestCert.pfx

@@ -59,4 +59,10 @@
     <Compile Include="CacheEncryptionTests.cs" />
   </ItemGroup>
 
+  <ItemGroup>
+    <None Update="Certificates\SelfSignedTestCert.pfx">
+      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+    </None>
+  </ItemGroup>
+
 </Project>