Aspnetcore: Handle the X-ARR-ClientCert header on Azure

[danroth27]

Based on the discussion in https://github.com/aspnet/mvc/issues/7366 it looks like Azure App Service will pass client certificates using the X-ARR-ClientCert header. We should investigate if we should add special handling for this header to surface the client certificate appropriately.

See also https://blogs.msdn.microsoft.com/kaevans/2016/04/13/azure-web-app-client-certificate-authentication-with-asp-net-core-2/

@blowdart @shirhatti

[blowdart]

Note that I already wrote middleware for this https://github.com/blowdart/idunno.Authentication/commit/b8b6cecb5f351d9e718a6a8daceea928de383036 - if we do it, it should be flexible enough to cope with other proxies, not just ARR.

[muratg]

@pakrym thinks we may be doing something similar (with a different header) in IISIntegration. He'll verify.

cc @Tratcher

[Tratcher]

ANCM forwards the client cert in a similar way, but that would be different from ARR. Didn't Azure's ARR do magic to unpack forwarded values like this before we observed them?

[blowdart]

Apparently not, because users had to hack their own bits to get the cert. We ought to go ask azure for a list of every possible header from ARR

[muratg]

@davidebbo is the list of all possible ARR headers captured somewhere?

[davidebbo]

@muratg sorry, not my area. Would need to find some IIS experts.

[muratg]

@pan-wang, do you know if such a list exists?

[pan-wang]

i am sure about X-ARR-SSL, X-ARR-ClientCert, X-ARR-LOG-ID, X-Forwarded-For and X-Forwarded-By, but not sure about X-ARR-CACHE-HIT which seems to be used as ServerVariable instead of forwarded header. Antares may add different headers.

[blowdart]

Well it's ARR so it'd be a question for Azure.

[oising]

Any movement on this?

[muratg]

Assigning to @shirhatti

[anurse]

We'll do this as part of https://github.com/aspnet/AspNetCore/issues/4663

[Eilon]

Re-opening because this is important for https://github.com/aspnet/AspNetCore/issues/4663

[HaoK]

https://github.com/aspnet/AspNetCore/pull/9756 adds the CertificateForwarding middleware for this