Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Extraction of thumbprint value through the certificate #389

Closed
wants to merge 4 commits into from
Closed

feat: Extraction of thumbprint value through the certificate #389

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0cc7414
extract thumbprint from cert value
JhontSouth Dec 7, 2023
3c7ed5e
fix documentation
JhontSouth Dec 7, 2023
8803011
keep previous constructor with new structure
JhontSouth Dec 7, 2023
133c9bc
include validation to avoid undefined.trim()
JhontSouth Dec 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion libraries/botframework-connector/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,8 @@
"cross-fetch": "^3.0.5",
"jsonwebtoken": "^9.0.0",
"rsa-pem-from-mod-exp": "^0.8.4",
"zod": "^3.22.4"
"zod": "^3.22.4",
"openssl-wrapper": "^0.3.4"
},
"devDependencies": {
"@types/jsonwebtoken": "8.3.5",
Expand Down
57 changes: 50 additions & 7 deletions libraries/botframework-connector/src/auth/certificateServiceClientCredentialsFactory.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,9 @@ import type { ServiceClientCredentials } from '@azure/ms-rest-js';
import { ServiceClientCredentialsFactory } from './serviceClientCredentialsFactory';
import { ok } from 'assert';
import { CertificateAppCredentials } from './certificateAppCredentials';
import { promisify } from 'util';
import * as opensslWrapper from 'openssl-wrapper';
const openssl = promisify(opensslWrapper.default);

/**
* A Certificate implementation of the [ServiceClientCredentialsFactory](xref:botframework-connector.ServiceClientCredentialsFactory) abstract class.
Expand Down Expand Up @@ -37,23 +40,51 @@ export class CertificateServiceClientCredentialsFactory extends ServiceClientCre
certificatePrivateKey: string,
tenantId?: string,
x5c?: string
);

/**
* Initializes a new instance of the CertificateServiceClientCredentialsFactory class.
*
* @param appId Microsoft application Id related to the certificate.
* @param x5c Value that enables application developers to achieve easy certificates roll-over in Azure AD
* set this parameter to send the public certificate (BEGIN CERTIFICATE) to Azure AD, so that Azure AD can use it to validate the subject name based on a trusted issuer policy.
ceciliaavila marked this conversation as resolved.
Show resolved Hide resolved
* @param certificatePrivateKey A PEM encoded certificate private key.
* @param tenantId Optional. The oauth token tenant.
*/
constructor(appId: string, x5c: string, certificatePrivateKey: string, tenantId?: string);

/**
* @internal
*/
constructor(
appId: string,
certificateThumbprintOrx5c: string,
certificatePrivateKey: string,
tenantId?: string,
x5c?: string
) {
super();

ok(appId?.trim(), 'CertificateServiceClientCredentialsFactory.constructor(): missing appId.');
ok(
certificateThumbprint?.trim(),
'CertificateServiceClientCredentialsFactory.constructor(): missing certificateThumbprint.'
);
ok(
certificatePrivateKey?.trim(),
'CertificateServiceClientCredentialsFactory.constructor(): missing certificatePrivateKey.'
);

if (certificateThumbprintOrx5c?.includes('-----BEGIN CERTIFICATE-----')) {
this.x5c = certificateThumbprintOrx5c;
} else {
ok(
certificateThumbprintOrx5c?.trim(),
'CertificateServiceClientCredentialsFactory.constructor(): missing certificateThumbprint or x5c value.'
);
this.certificateThumbprint = certificateThumbprintOrx5c;
this.x5c = x5c;
}

this.appId = appId;
this.certificateThumbprint = certificateThumbprint;
this.certificatePrivateKey = certificatePrivateKey;
this.tenantId = tenantId;
this.x5c = x5c;
}

/**
Expand All @@ -63,6 +94,18 @@ export class CertificateServiceClientCredentialsFactory extends ServiceClientCre
return appId === this.appId;
}

/**
* @param cert Value with the certificate content.
* @returns The thumbprint value calculated from the cert content.
*/
private async getThumbprint(cert) {
const fingerprintResponse = await openssl('x509', Buffer.from(cert), { fingerprint: true, noout: true });
return Buffer.from(fingerprintResponse)
.toString()
.replace(/^.*Fingerprint=/, '')
.replace(/:/g, '')
.trim();
}
/**
* @inheritdoc
*/
Expand All @@ -82,7 +125,7 @@ export class CertificateServiceClientCredentialsFactory extends ServiceClientCre

return new CertificateAppCredentials(
this.appId,
this.certificateThumbprint,
this.certificateThumbprint ?? (await this.getThumbprint(this.x5c)),
this.certificatePrivateKey,
this.tenantId,
audience,
Expand Down
5 changes: 5 additions & 0 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10254,6 +10254,11 @@ [email protected], open@^8.0.0:
is-docker "^2.1.1"
is-wsl "^2.2.0"

openssl-wrapper@^0.3.4:
version "0.3.4"
resolved "https://registry.yarnpkg.com/openssl-wrapper/-/openssl-wrapper-0.3.4.tgz#c01ec98e4dcd2b5dfe0b693f31827200e3b81b07"
integrity sha512-iITsrx6Ho8V3/2OVtmZzzX8wQaKAaFXEJQdzoPUZDtyf5jWFlqo+h+OhGT4TATQ47f9ACKHua8nw7Qoy85aeKQ==

optionator@^0.8.1:
version "0.8.3"
resolved "https://registry.yarnpkg.com/optionator/-/optionator-0.8.3.tgz#84fa1d036fe9d3c7e21d99884b601167ec8fb495"
Expand Down
Loading