Two way SSL for FeathersJS using Socket.IO with custom authentication - node.js

Question

I'm trying to get a FeatherJS app up and running using two way ssl for authentication over Socket.IO. I've built a simple cert strategy, verifier, etc.. to handle the task of validating that the user presented is a valid user.
However -- at this point everything I try keeps sending me in loops. I swear it doesn't appear that the authentication is running and when I do get it to finally kick out some debugging messages the peerCert is never present.
What am I doing wrong here?
index.js
const server = https.createServer({
key: fs.readFileSync('certificates/my.key'),
cert: fs.readFileSync('certificates/my-cert.pem'),
ca: fs.readFileSync('certificates/ca/my-ca.pem'),
requestCert: true,
rejectUnauthorized: true
}, app).listen(port);
app.setup(server);
Now the first time I hit the site I DO get prompted for a certificate but, I can't see any evidence that that cert gets to my authentication service.
app.js
const feathers = require('feathers');
const configuration = require('feathers-configuration');
const hooks = require('feathers-hooks');
const socketio = require('feathers-socketio');
const handler = require('feathers-errors/handler');
const notFound = require('feathers-errors/not-found');
const middleware = require('./middleware');
const services = require('./services');
const appHooks = require('./app.hooks');
const authentication = require('./authentication');
const app = feathers();
// Load app configuration
app.configure(configuration());
// Enable CORS, security, compression, favicon and body parsing
app.use(cors());
app.use(helmet());
app.use(compress());
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: true }));
app.use(favicon(path.join(app.get('public'), 'favicon.ico')));
// Host the public folder
app.use('/', feathers.static(app.get('public')));
// Set up Plugins and providers
app.configure(hooks());
app.configure(socketio());
// Configure other middleware (see `middleware/index.js`)
app.configure(middleware);
app.configure(authentication);
// Set up our services (see `services/index.js`)
app.configure(services);
// Configure a middleware for 404s and the error handler
app.use(notFound());
app.use(handler());
app.hooks(appHooks);
module.exports = app;
authentication.js
const authentication = require('feathers-authentication');
const jwt = require('feathers-authentication-jwt');
const cert = require('./feathers-authentication-cert.js');
module.exports = function () {
const app = this;
const config = app.get('authentication');
// Set up authentication with the secret
app.configure(authentication(config));
app.configure(jwt());
app.configure(cert());
// The `authentication` service is used to create a JWT.
// The before `create` hook registers strategies that can be used
// to create a new valid JWT (e.g. local or oauth2)
app.service('authentication').hooks({
before: {
create: [authentication.hooks.authenticate(config.strategies)],
remove: [authentication.hooks.authenticate('jwt')]
}
});
};
feathers-authentication-cert.js
const Debug = require('debug');
const merge = require('lodash.merge');
const omit = require('lodash.omit');
const pick = require('lodash.pick');
const DefaultVerifier = require('./cert-verifier.js');
const ClientCertStrategy = require('./cert-strategy.js').Strategy;
const debug = Debug('feathers-authentication-cert');
const defaults = {
name: 'cert'
};
const KEYS = [
'passReqToCallback',
'session'
];
function init(options = {}) {
return function certAuth() {
const app = this;
const _super = app.setup;
if (!app.passport) {
throw new Error(`Can not find app.passport. Did you initialize feathers-authentication before feathers-authentication-cert?`);
}
let name = options.name || defaults.name;
let authOptions = app.get('authentication') || {};
let localOptions = authOptions[name] || {};
const localSettings = merge({}, defaults, pick(authOptions, KEYS), localOptions, omit(options, ['Verifier']));
let Verifier = DefaultVerifier;
if (options.Verifier) {
Verifier = options.Verifier;
}
app.setup = function () {
let result = _super.apply(this, arguments);
let verifier = new Verifier(app, localSettings);
if (!verifier.verify) {
throw new Error(`Your verifier must implement a 'verify' function. It should have the same signature as a local passport verify callback.`)
}
// Register 'cert' strategy with passport
debug('Registering cert authentication strategy with options:', localSettings);
app.passport.use(localSettings.name, new ClientCertStrategy(localSettings, verifier.verify.bind(verifier)));
app.passport.options(localSettings.name, localSettings);
return result;
}
};
}
// Exposed Modules
Object.assign(init, {
defaults,
Verifier: DefaultVerifier
});
module.exports = init;
cert-strategy.js
const util = require('util');
const Strategy = require('passport-strategy');
/*
* passport.js TLS client certificate strategy
*/
function ClientCertStrategy(options, verify) {
if (typeof options == 'function') {
verify = options;
options = {};
}
if (!verify) throw new Error('Client cert authentication strategy requires a verify function');
Strategy.call(this);
this.name = 'client-cert';
this._verify = verify;
this._passReqToCallback = options.passReqToCallback;
}
util.inherits(ClientCertStrategy, Strategy);
ClientCertStrategy.prototype.authenticate = function(req, options) {
var that = this;
console.log('Request', req);
// Requests must be authorized
// (i.e. the certificate must be signed by at least one trusted CA)
if(!req.socket.authorized) {
that.fail();
} else {
var clientCert = req.socket.getPeerCertificate();
// The cert must exist and be non-empty
if(!clientCert || Object.getOwnPropertyNames(clientCert).length === 0) {
that.fail();
} else {
var verified = function verified(err, user) {
if (err) { return that.error(err); }
if (!user) { return that.fail(); }
that.success(user);
};
if (this._passReqToCallback) {
this._verify(req, clientCert, verified);
} else {
this._verify(clientCert, verified);
}
}
}
};
module.exports.Strategy = ClientCertStrategy;
cert-verifier.js
class CertVerifier {
constructor (app, options = {}) {
this.app = app;
this.options = options;
this.verify = this.verify.bind(this);
}
verify(req, cert, done) {
console.log(req.socket);
done= () => {
console.log('done?');
}
var subject = cert.subject;
var msg = 'Attempting PKI authentication';
if(!subject) {
console.log(msg + ' ✘ - no subject'.red);
done(null, false);
} else if(!subject.CN) {
console.log(msg + '✘ - no client CN'.red);
done(null, false);
} else {
var cn = subject.CN;
lookupUser(cn, function(err, user) {
msg = 'Authenticating ' + cn + ' with certificate';
if(!user) {
console.log(msg + ' ✘ - no such user'.red);
done(null, false);
} else {
console.log(msg + ' - ✔'.green);
done(null, user);
}
});
}
}
}
module.exports = CertVerifier;