feat: add mTLS client certificate support

Author: phillipleblanc

Spice/src/Flight/SpiceFlightClient.cs

@@ -21,6 +21,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 */
 
 using System.Net.Http.Headers;
+using System.Security.Cryptography.X509Certificates;
 using Apache.Arrow.Flight;
 using Apache.Arrow.Flight.Client;
 using Grpc.Core;
@@ -39,7 +40,7 @@ internal class SpiceFlightClient : IDisposable
     private readonly HttpClient? _httpClient;
     private readonly AsyncRetryPolicy _retryPolicy;
 
-    private static GrpcChannelOptions GetGrpcChannelOptions(string? appId, string? apiKey, string? userAgent, bool useTls)
+    private static GrpcChannelOptions GetGrpcChannelOptions(string? appId, string? apiKey, string? userAgent, bool useTls, string? tlsClientCertFile = null, string? tlsClientKeyFile = null)
     {
         var options = new GrpcChannelOptions();
 
@@ -57,12 +58,13 @@ private static GrpcChannelOptions GetGrpcChannelOptions(string? appId, string? a
                 var handler = new SocketsHttpHandler
                 {
                     EnableMultipleHttp2Connections = true,
-                    // Force periodic connection recycling to trigger DNS re-resolution.
-                    // Without this, HTTP/2 connections are kept alive indefinitely and
-                    // the client can get stuck on stale IPs when backend targets change
-                    // (e.g. AWS ALB target rotation).
                     PooledConnectionLifetime = TimeSpan.FromMinutes(5),
                 };
+                if (tlsClientCertFile != null && tlsClientKeyFile != null)
+                {
+                    var clientCert = X509Certificate2.CreateFromPemFile(tlsClientCertFile, tlsClientKeyFile);
+                    handler.SslOptions.ClientCertificates = new X509Certificate2Collection { clientCert };
+                }
                 options.HttpHandler = handler;
             }
 #endif
@@ -80,12 +82,13 @@ private static GrpcChannelOptions GetGrpcChannelOptions(string? appId, string? a
             messageHandler = new SocketsHttpHandler
             {
                 EnableMultipleHttp2Connections = true,
-                // Force periodic connection recycling to trigger DNS re-resolution.
-                // Without this, HTTP/2 connections are kept alive indefinitely and
-                // the client can get stuck on stale IPs when backend targets change
-                // (e.g. AWS ALB target rotation).
                 PooledConnectionLifetime = TimeSpan.FromMinutes(5),
             };
+            if (tlsClientCertFile != null && tlsClientKeyFile != null)
+            {
+                var clientCert = X509Certificate2.CreateFromPemFile(tlsClientCertFile, tlsClientKeyFile);
+                ((SocketsHttpHandler)messageHandler).SslOptions.ClientCertificates = new X509Certificate2Collection { clientCert };
+            }
         }
         else
 #endif
@@ -112,13 +115,13 @@ private static GrpcChannelOptions GetGrpcChannelOptions(string? appId, string? a
         return responseHeaders.Get("authorization") ?? trailers.Get("authorization");
     }
 
-    internal SpiceFlightClient(string address, int maxRetries, string? appId, string? apiKey, string? userAgent, bool useTls)
+    internal SpiceFlightClient(string address, int maxRetries, string? appId, string? apiKey, string? userAgent, bool useTls, string? tlsClientCertFile = null, string? tlsClientKeyFile = null)
     {
         _retryPolicy = RetryPolicyFactory.CreateRpcRetryPolicy(
             maxRetries,
             (ex, ts, attempt) => RetryPolicyFactory.LogRetry("Flight", ex, ts, attempt));
 
-        var options = GetGrpcChannelOptions(appId, apiKey, userAgent, useTls);
+        var options = GetGrpcChannelOptions(appId, apiKey, userAgent, useTls, tlsClientCertFile, tlsClientKeyFile);
         _httpClient = options.HttpClient;
 
         _channel = GrpcChannel.ForAddress(address, options);

Spice/src/SpiceClient.cs

@@ -66,14 +66,26 @@ public class SpiceClient : IDisposable
     /// </summary>
     public bool UseTls { get; internal set; }
 
+    /// <summary>
+    /// Gets or sets the path to a PEM-encoded client certificate file for mTLS.
+    /// Must be used together with <see cref="TlsClientKeyFile"/>.
+    /// </summary>
+    public string? TlsClientCertFile { get; internal set; }
+
+    /// <summary>
+    /// Gets or sets the path to a PEM-encoded client private key file for mTLS.
+    /// Must be used together with <see cref="TlsClientCertFile"/>.
+    /// </summary>
+    public string? TlsClientKeyFile { get; internal set; }
+
     private SpiceFlightClient? FlightClient { get; set; }
     private SpiceAdbcClient? AdbcClient { get; set; }
     private SpiceHttpClient? HttpClient { get; set; }
 
 
     internal void Init()
     {
-        FlightClient = new SpiceFlightClient(FlightAddress, MaxRetries, AppId, ApiKey, UserAgent, UseTls);
+        FlightClient = new SpiceFlightClient(FlightAddress, MaxRetries, AppId, ApiKey, UserAgent, UseTls, TlsClientCertFile, TlsClientKeyFile);
         AdbcClient = new SpiceAdbcClient(FlightAddress, MaxRetries, AppId, ApiKey, UserAgent, UseTls);
         HttpClient = new SpiceHttpClient(HttpAddress, AppId, ApiKey, UserAgent);
     }

Spice/src/SpiceClientBuilder.cs

@@ -148,6 +148,20 @@ public SpiceClientBuilder WithTls(bool useTls = true)
         return this;
     }
 
+    /// <summary>
+    /// Sets the paths to PEM-encoded client certificate and key files for mTLS.
+    /// </summary>
+    /// <param name="certFile">Path to the client certificate PEM file.</param>
+    /// <param name="keyFile">Path to the client private key PEM file.</param>
+    /// <returns>The current instance of <see cref="SpiceClientBuilder"/> for method chaining.</returns>
+    public SpiceClientBuilder WithTlsClientCertificate(string certFile, string keyFile)
+    {
+        _spiceClient.TlsClientCertFile = certFile;
+        _spiceClient.TlsClientKeyFile = keyFile;
+        _spiceClient.UseTls = true;
+        return this;
+    }
+
     /// <summary>
     /// Initiates <see cref="SpiceClient" /> with provided parameters.
     /// </summary>