mTLS using Azure Function HTTP Trigger?

Question

I'm working at building an auth token server using a Python Azure Function with HTTP trigger. The goal is to use mutual TLS (mTLS) authentication.

The way it will work:

Client sends http request to Function endpoint with two headers:

requestor-id : an identifier used for lookups
X-ARR-ClientCert : a string representation of their .pem certificate

The Function will look in a database where requestor's .pem has been previously shared
Using pyOpenSSL, the Function will load the two .pem files and compare the request cert and the retrieved certs:

not_valid_before/after dates
common name
issuer
thumbprint

If each property of the certs match, the Function will respond with an auth token for use in a downstream data call

My question is:

This isn't really "mutual" as the server hosting the Function code is not presenting its certificate anywhere (visible) in the handshake.
Is the server side of mTLS handshake configured elsewhere or does it "just work" because the Function endpoint is https out of the box?

Jim Xu · Accepted Answer · 2020-10-12 05:48:03Z

4

If you want to mutual TLS (mTLS) authentication in Azure function app, you just need to enable client certificates. After doing that, Function App Service injects an X-ARR-ClientCert request header with the client certificate. Function App Service does not do anything with this client certificate other than forwarding it to your app. Your app code is responsible for validating the client certificate. FOr more details, please refer to here and here

answered Oct 12, 2020 at 5:48

Jim Xu

23.2k2 gold badges24 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

SeaDude Over a year ago

Thank you @JimXu. I'm stuck at how to access the X-ARR-ClientCert header using Python Function code. There are a few examples of C#, but not one have I found for using Python. Do you know how this header is accessed?

SeaDude Over a year ago

Disregard. @krishg helped me over here.

Collectives™ on Stack Overflow

mTLS using Azure Function HTTP Trigger?

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related