Cli-microsoft365: Update command: m365 login, allow empty password for a pfx certificate

[YannickRe]

Usage

m365 login [options]

Description

Allow to login with a .pfx certificate that doesn't require a password.

Options

Unsure how this would be achieved (for now), just believe this should be possible.

Additional Information

I believe we should be able to use a .pfx certificate that doesn't have a password (this is the case when fetching a base64 encoded certificate from Azure Key Vault). Currently, when you don't use the --password option CLI assumes a .pem file is passed in to the --certificateFile option. Naturally, this doesn't achieve the wanted result.
Additionally, you cannot pass in an empty password to the --password option. This always results in errors.

[waldekmastykarz]

Thanks for the suggestion. By itself, it's pretty odd though. PFX is secured by password so why would you want to use it without a password?

[YannickRe]

There is no rule that a .pfx needs to be protected by a password. When you export a .pfx certificate from Azure KeyVault, it doesn’t have a password. When you make a .pfx from a base64 encoded string, it doesn’t necessarily have a password.
Even if you export a .pfx from the Windows Certificate Store you don’t HAVE to provide a password.

It would make CLI support certificates like this, even if we consider it bad form 🙂

[waldekmastykarz]

Right, so the recommendation is to protect your .pfx with a password because it contains a private key, but it's not necessary. Good catch! We should definitely update CLI to not require password.

[YannickRe]

I'll take this one too, if you want. This can be the preparation to cleanly allow #1971 to be implemented.
Approach:

1. limit (and thus validate) input to .pem and .pfx files (we could extend it afterwards, but this is what your docs currently refer to as being allowed)
2. set certType to either pem or pfx, and in Auth.ts use that to switch between both logic paths

Sounds good?

[waldekmastykarz]

Sounds like a plan! Appreciate your help! 👏

[YannickRe]

I didn't like my plan anymore, thinking of how to implement this one so we could easily also implement #1971 .

Current approach:

• assume certificate in Buffer is PEM, and decode it.
  
  
  
  • if works => great, it is PEM
  
  
  • if fails with exception ==> assume PFX and continue PFX code path
  
  

It's not the cleanest of code but I cannot figure out how to determine if a base64 encoded string is a pem or a pfx without doing the actual conversion and letting it throw the exception if it isn't pem.
Also, I figured it isn't worse than the current solution since that assumes PEM when --password is not provided with no fallback.

I get it might be difficult to follow along without seeing the actual code. It's more for future reference: as an answer to why the implementation differs from what has been discussed.

[garrytrinder]

I get it might be difficult to follow along without seeing the actual code.

Feel free to submit a draft PR and lets discuss 😊👍🏻

[YannickRe]

@garrytrinder The PR is waiting for you 😉