[Feature request] Support passing clientCertificate to initialize ClientCertificateCredential

[formulahendry]

In .NET SDK, it is supported to pass X509 Certificate to initialize ClientCertificateCredential:
https://docs.microsoft.com/en-us/dotnet/api/azure.identity.clientcertificatecredential.-ctor?view=azure-dotnet#Azure_Identity_ClientCertificateCredential__ctor_System_String_System_String_System_Security_Cryptography_X509Certificates_X509Certificate2_

However, in JS SDK, it seems only to support pass certificatePath to initialize ClientCertificateCredential:

azure-sdk-for-js/sdk/identity/identity/src/credentials/clientCertificateCredential.ts

Line 34 in 2c381b2

constructor(

Want to have similar feature in JS SDK. Thanks!

[sadasant]

Thank you, @formulahendry ! We have an important release soon, so I’m moving this to the backlog. We’ll pick this up in the upcoming months. Thank you for your feedback!

[gregorwolf]

Would be great if this issue can get prioritized. We need to establish a connection to Microsoft Graph using ClientCertificateCredential but running in a Cloud Foundry environment (SAP BTP). There we can read the centrally stored credentials using the so called destination service. It provides us the certificate in a JSON response. Avoiding the need to store it first to a file would help a lot.

[sadasant]

@gregorwolf I’m cycling back with my team to see if we can do something more expedite.

[gregorwolf]

Hi @sacheu,

for the moment I've fond a solution using the pkcs12 support of node-forge. That way I can create the needed PEM file for ClientCertificateCredential:

    // decode p12 from base64
    var p12Der = forge.util.decode64(sdkDestination.certificates[0].content);
    // get p12 as ASN.1 object
    var p12Asn1 = forge.asn1.fromDer(p12Der);
    // decrypt p12 using non-strict parsing mode (resolves some ASN.1 parse errors)
    const p12 = forge.pkcs12.pkcs12FromAsn1(p12Asn1, false, sdkDestination.keyStorePassword);
    // get Bags containing the certificate
    const certBags = p12.getBags({ bagType: forge.pki.oids.certBag });
    // the first Bag contains the public key
    const { cert } = certBags[forge.pki.oids.certBag][0];
    // convert Certificate to PEM format
    const certificatePem = forge.pki.certificateToPem(cert);
    // read the Bags with Private Keys
    const privateBags = p12.getBags({ bagType: forge.pki.oids.pkcs8ShroudedKeyBag });
    // the first Bag contains the private key
    const { key } = privateBags[forge.pki.oids.pkcs8ShroudedKeyBag][0];
    // convert a Forge private key to an ASN.1 RSAPrivateKey
    const privateKey = forge.pki.privateKeyToAsn1(key);
    // wrap an RSAPrivateKey ASN.1 object in a PKCS#8 ASN.1 PrivateKeyInfo
    const privateKeyInfo = forge.pki.wrapRsaPrivateKey(privateKey);
    // convert Private Key to PEM format
    const privateKeyPem = forge.pki.privateKeyInfoToPem(privateKeyInfo);
    // concatenate Certificate and Private Key
    const pem = certificatePem + "\r\n" + privateKeyPem;
    // write in PEM format
    const data = fs.writeFileSync(PATH_TO_CERTIFICATE, pem);

But it would be great if I can pass directly the pem Variable instead of a PATH_TO_CERTIFICATE to ClientCertificateCredential.

[sadasant]

Thank you for your feedback so far. We’ll be working on studying adding support for X509 Certificates in the upcoming months. This month we’ll be exploring our options on how to accept the certificate contents directly as part of our v2 API- possibly requiring either a path to the certificate on the filesystem, or the string contents of the certificate (PEM only, for now).

[KarishmaGhiya]

@formulahendry Since the release 2.1.0 of @azure/identity (Aug 2022) we have added support for being able to pass in ClientCertificatePEMCertificate with the PEM certificate as a string. You can use our latest version of @azure/identity to test it out. If you have any concerns with the feature, please file another issue as a bug. Thanks so much for requesting this feature!

[github-actions]

Hi @formulahendry. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.