Azure Functions - Configure client certificate authentication - azure

Question

Do functions support authorizing access to a Function by using client certificates, in a consumption plan? Something similar to the approach described here? Basically, I'm looking for the Functions runtime to immediately reject connection requests if the caller does not present a valid client certificate, without me having to implement that authorization routine in the code.

Answer 1

Here's the code I came up with, note: this is for Azure Functions v1, when req is an HttpRequestMessage
Caller:
X509Certificate2 clientCert = req.GetClientCertificate();
if (!IsValidClientCertificate(clientCert))
{
return req.CreateErrorResponse(HttpStatusCode.Unauthorized, "A valid client certificate is not found");
}
For Azure Functions v2, you can get the client certificate from the HttpRequest using req.HttpContext.Connection.ClientCertificate
Basic validation function:
static bool IsValidClientCertificate(X509Certificate2 clientCert)
{
// check the cert's thumbprint against expected thumbprint
if (clientCert.Thumbprint != "<expected thumprint>"
{
return false;
}
// check that we're within the cert's validity period
if (DateTime.Now > clientCert.NotAfter || DateTime.Now < clientCert.NotBefore)
{
return false;
}
// optionally check cert chaining validity
// if(!clientCert.Verify()) { return false; }
}

Answer 2

Based on your requirement, I created my C# HttpTrigger function to check this issue, here is the core code:
if(req.Headers.Contains("X-ARR-ClientCert"))
{
byte[] clientCertBytes = Convert.FromBase64String(req.Headers.GetValues("X-ARR-ClientCert").FirstOrDefault());
var clientCert = new X509Certificate2(clientCertBytes);
return req.CreateResponse(HttpStatusCode.OK,"Thumbprint: "+clientCert.Thumbprint);
}
return req.CreateResponse(HttpStatusCode.OK, "Hello world");
For App Service Plan, the function could work as follows:
Per my test, the function could also work as expected under the consumption plan.
You could follow How To Configure TLS Mutual Authentication for Web App or just log into Azure Portal and go to your function app, click "NETWORKIING > SSL" under Platform fetures tab, then enable Incoming client certificate option.

Answer 3

Yes it does. If I understand you correctly, you want to reject with a 403, any https requests without a client cert
This is how to enable it with Azure CLI
az webapp update --set clientCertEnabled=true --name <app_name> --resource-group <group_name>
Microsoft docs here
You can also do this from the Azure Portal, under Azure Function App => Configuration => General Settings