create client side certificate authentication and mTLS

[devops724]

Hi there
i want add client side certificate and authorization
https://github.com/sevcsik/client-certificate-demo/
or
https://github.com/julie-ng/nodejs-certificate-auth

how i can i add this authenticate method to feathers 5(Dove)

[daffl]

When using Express it works the same as in the examples linked. Also see https://feathersjs.com/api/express.html#https and https://feathersjs.com/api/express.html#custom-service-middleware

[devops724]

i want allow multiple strategy use token base for users and cert for IOT device
i want handle it in authentication
this code not work

class CustomCertStrategy extends AuthenticationBaseStrategy {
  constructor(headerField = "cert") {
    super();
    this.headerField = headerField;
  }

  async authenticate(authRequest, params) {
    if (authRequest.strategy == "cert")
      if (!(params.authentication || {}).is_authorized) {
        throw new NotAuthenticated("Invalid Certificate");
      }
    return {
      cert: 'valid',
    };
  }
  parse(req, res) {
    let cert = null;
    let authorized = false;
    if (req.socket && (req.body || {})["strategy"] == "cert") {
      cert = req.socket.getPeerCertificate();
      if (req.client.authorized) {
        authorized = req.client.authorized;
      }
      else if (cert.subject) {
        throw new NotAuthenticated(`Sorry ${cert.subject.CN}, certificates from ${cert.issuer.CN} are not welcome here.`)
        // And last, they can come to us with no certificate at all:
      } else {
        throw new NotAuthenticated(`Sorry, but you need to provide a client certificate to continue.`)
      }

    }
    if ((req.body || {})["strategy"] == "cert")
      return {
        is_authorized: authorized,
        "strategy": "cert"
      };
    return null;
  }
}

[devops724]

seems i need access socket connection in CustomCertStrategy authentication class.
is there a way access to socket there?

[devops724]

i can make it work with this code
middleware.js

module.exports = function (app) {
  // Add your custom middleware here. Remember that
  // in Express, the order matters.
  app.use(function(req, res, next) {
    req.feathers.mTLSAuthorized = req.client.authorized;
})

app.js

app.configure(socketio(function (io) {
  io.use(function (socket, next) {
    // console.log(socket)
    socket.feathers.mTLSAuthorized = socket.conn.request.websocket._socket.authorized;
})
})

custom auth method

class CustomCertStrategy extends AuthenticationBaseStrategy {
  constructor(headerField = "cert") {
    super();
    this.headerField = headerField;
  }


  async authenticate(authRequest, params) {
    
    if (authRequest.strategy == "cert")
      if (!params.mTLSAuthorized) {
        throw new NotAuthenticated("Invalid Certificate");
      }
    return {
      cert: 'valid',
    };
  }
  
}