[API Proposal]: Provide async callback for ClientCertificateValidation in Kestrel

[galakt]

Background and motivation

It is currently possible to have a custom client certificate validation in Kestrel using

HttpsConnectionAdapterOptions.ClientCertificateValidation

However, it is currently impossible to have async validation without sync-over-async, since the signature of the callback is as below:
public Func<X509Certificate2, X509Chain?, SslPolicyErrors, bool>? ClientCertificateValidation { get; set; }

Example:

public static IHostBuilder CreateHostBuilder(string[] args) =>
      Host.CreateDefaultBuilder(args)
          .ConfigureWebHostDefaults(webBuilder =>
          {
              webBuilder.UseKestrel(p =>
              {
                  p.ConfigureHttpsDefaults(s =>
                  {
                      s.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
                      s.ClientCertificateValidation = (X509Certificate2 cert, X509Chain chain, SslPolicyErrors e) =>
                      {
                          Task<bool> someValidationTask = ...;
                          return someValidationTask.GetAwaiter().GetResult(); // sync-over-async
                      };
                  });
              });

              webBuilder.UseStartup<Startup>();
          });

Intention is similar to dotnet/runtime#79441

API Proposal

namespace Microsoft.AspNetCore.Server.Kestrel.Https;

public Func<X509Certificate2, X509Chain?, SslPolicyErrors, ValueTask<bool>>? ClientCertificateValidation { get; set; }

API Usage

public static IHostBuilder CreateHostBuilder(string[] args) =>
      Host.CreateDefaultBuilder(args)
          .ConfigureWebHostDefaults(webBuilder =>
          {
              webBuilder.UseKestrel(p =>
              {
                  p.ConfigureHttpsDefaults(s =>
                  {
                      s.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
                      s.ClientCertificateValidation = async (X509Certificate2 cert, X509Chain chain, SslPolicyErrors e) =>
                      {
                          Task<bool> someValidationTask = ...;
                          return await someValidationTask;
                      };
                  });
              });

              webBuilder.UseStartup<Startup>();
          });

Alternative Designs

No response

Risks

Presence of two callbacks (sync and async) may confuse

[galakt]

Uff, I think dotnet/aspnetcore is a better place for this issue. Should I close this one and create new one in dotnet/aspnetcore?

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Background and motivation

It is currently possible to have a custom client certificate validation in Kestrel using

HttpsConnectionAdapterOptions.ClientCertificateValidation

However, it is currently impossible to have async validation without sync-over-async, since the signature of the callback is as below:
public Func<X509Certificate2, X509Chain?, SslPolicyErrors, bool>? ClientCertificateValidation { get; set; }

Example:

public static IHostBuilder CreateHostBuilder(string[] args) =>
      Host.CreateDefaultBuilder(args)
          .ConfigureWebHostDefaults(webBuilder =>
          {
              webBuilder.UseKestrel(p =>
              {
                  p.ConfigureHttpsDefaults(s =>
                  {
                      s.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
                      s.ClientCertificateValidation = (X509Certificate2 cert, X509Chain chain, SslPolicyErrors e) =>
                      {
                          Task<bool> someValidationTask = ...;
                          return someValidationTask.GetAwaiter().GetResult(); // sync-over-async
                      };
                  });
              });

              webBuilder.UseStartup<Startup>();
          });

Intention is similar to dotnet/runtime#79441

API Proposal

namespace Microsoft.AspNetCore.Server.Kestrel.Https;

public Func<X509Certificate2, X509Chain?, SslPolicyErrors, ValueTask<bool>>? ClientCertificateValidation { get; set; }

API Usage

public static IHostBuilder CreateHostBuilder(string[] args) =>
      Host.CreateDefaultBuilder(args)
          .ConfigureWebHostDefaults(webBuilder =>
          {
              webBuilder.UseKestrel(p =>
              {
                  p.ConfigureHttpsDefaults(s =>
                  {
                      s.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
                      s.ClientCertificateValidation = async (X509Certificate2 cert, X509Chain chain, SslPolicyErrors e) =>
                      {
                          Task<bool> someValidationTask = ...;
                          return await someValidationTask;
                      };
                  });
              });

              webBuilder.UseStartup<Startup>();
          });

Alternative Designs

No response

Risks

Presence of two callbacks (sync and async) may confuse

Author:	galakt
Assignees:	-
Labels:	api-suggestion, area-System.Net.Security, untriaged
Milestone:	-

[wfurt]

I guess this would still depend on dotnet/runtime#79441 unless Kestrel wants to deal with the asynchronous somehow.

[davidfowl]

Yes, this needs to happen in SSLStream first.

[amcasey]

As others mentioned in dotnet/runtime#79441, I'm kind of nervous about the prospect of having two essentially identical callback APIs that differ only in async-ness.

I assume, based on the requests, that having relatively heavyweight and/or async-calling validation callbacks is a common and/or important use case?

[mitchdenny]

If you are using client certificates to uniquely identify each user, then you need to have that certificate information for each user principal in a data store which you would most likely access asynchronously the first time when a server interacts with that user. However, once you've got it you'd probably try to cache it.