Secure Client Authentication with Authorization Code flow

[daver77]

Hi, my conformance report is giving me a warning for a client which is configured with authorization code flow

Consider migrating to private_key_jwt or mTLS authentication for enhanced security. Client uses shared secret authentication. OAuth 2.1 recommends private_key_jwt or mTLS for confidential clients.

Is there any documentation on how to setup the above with mTLS? I can only see documentation for adding client certificates to API calls.

[wcabus]

We currently indeed only have documentation showing how to configure mTLS for native clients, including a sample implementation.

In an ASP.NET Core client, adding mTLS support involves a few steps, since ASP.NET Core's default OIDC authentication handler implementation doesn't know how to switch to mTLS.

1. Configure the OpenIdConnectOptions.BackchannelHttpHandler to use a client certificate, for example:

   var certPath = builder.Configuration["CertificateSettings:Path"]
       ?? throw new InvalidOperationException("CertificateSettings:Path is not configured.");
   var certPassword = builder.Configuration["CertificateSettings:Password"];
   var clientCertificate = X509CertificateLoader.LoadPkcs12FromFile(certPath, certPassword);
   
   options.BackchannelHttpHandler = new SocketsHttpHandler
   {
       SslOptions = new SslClientAuthenticationOptions
       {
           ClientCertificates = new X509CertificateCollection { clientCertificate }
       }
   };

2. Create a custom configuration manager type which reads the mtls_endpoint_aliases from Duende IdentityServer's discovery document and replaces the default endpoint locations with their respective mTLS alias. I created a sample implementation as a Gist.

3. Use the custom configuration manager when configuring the OpenID Connect authentication handler:

   var discoDocRetriever = new HttpDocumentRetriever(new HttpClient());
   
   options.ConfigurationManager = new MtlsConfigurationManager(
       $"{options.Authority}/.well-known/openid-configuration",
       new OpenIdConnectConfigurationRetriever(),
       discoDocRetriever);

IdentityServer will then also issue access tokens that are bound to the certificate: a cnf claim will be present so that APIs can verify the ownership of the access token. This, however, also requires the client application to call the API using the client certificate, and custom middleware in the API to match the client certificate's thumbprint with the cnf claim value.

That said, using private_key_jwt for client authentication and DPoP for proof-of-possession are easier to achieve in ASP.NET Core. Here's a sample showcasing private_key_jwt client assertions.

[daver77]

Thanks, I think I will go down the easier route!