X509 Certificate Authentication Fails with Tenants and/ or Sub Oraganizations

[dhaura]

Describe the issue: X509 certificate authenticator fails for tenanted and/ or B2B users.

How to reproduce:

1. Setup X509 certificate authenticator in WSO2 IS [1].
2. Create a new tenant/ B2B organization.
3. Create a traditional web app for the tenant/ suborg. (for suborgs, an app can be created in the super tenant and shared it with the suborg)
4. Configure basic authentication as the first step and X509 certificate authenticator as the second step for the newly created application.
5. Create a new user in the tenant/ suborg.
6. Create a x509 certificate for the created user following the steps in [2].
7. Upload the certificate into the browser.
8. Try login into the application with the tenanted/ suborg user.

Expected behavior: Successful authentication when a valid x509 certificate is passed for tenanted/ suborg users.

Environment information:

• Product Version: IS 7.0.0
• OS: macos
• Database: default
• Userstore: default

---

Related issues:

• https://github.com/wso2/product-is/issues/11408
• https://github.com/wso2/product-is/issues/11934

[1] - https://is.docs.wso2.com/en/7.0.0/guides/authentication/mfa/add-x509-login [2] - https://is.docs.wso2.com/en/7.0.0/guides/authentication/mfa/add-x509-login/#configure-x509-certificate-authenticator

[dhaura]

Root Cause Analysis - Tenanted Scenario

• When validating the certificate, it checks whether the associated user's account is disabled in [1] and calls the method createLocalAuthenticatedUserFromSubjectIdentifier() to get the authenticated user with the related username.
• Moreover, there was a change [2] done to the method createLocalAuthenticatedUserFromSubjectIdentifier() in order to fix the issue [3], where instead of getting the tenant domain of the user from the username itself, it is implemented to extract it from the thread local carbon context [4].
• But this returns carbon.super even for a tenanted user since the commonauth url returned [5] by the x509 certificate servlet is not tenanted.
• Therefore, isAccountDisabled method [6] fails due to the invalid tenant domain of the user.

[1] - https://github.com/wso2-extensions/identity-outbound-auth-x509/blob/2f12dcfb92bb147379efff6cf491f7d2c5cb18f4/component/authenticator/src/main/java/org/wso2/carbon/identity/authenticator/x509Certificate/X509CertificateAuthenticator.java#L366 [2] - https://github.com/wso2/carbon-identity-framework/pull/5374 [3] - https://github.com/wso2/product-is/issues/18795 [4] - https://github.com/wso2/carbon-identity-framework/blob/c2722c245ac8088bc4e0f7535caa678043c4de75/components/authentication-framework/org.wso2.carbon.identity.application.authentication.framework/src/main/java/org/wso2/carbon/identity/application/authentication/framework/model/AuthenticatedUser.java#L168-L169 [5] - https://github.com/wso2-extensions/identity-outbound-auth-x509/blob/2f12dcfb92bb147379efff6cf491f7d2c5cb18f4/component/authenticator/src/main/java/org/wso2/carbon/identity/authenticator/x509Certificate/X509CertificateServlet.java#L84 [6] - https://github.com/wso2-extensions/identity-outbound-auth-x509/blob/2f12dcfb92bb147379efff6cf491f7d2c5cb18f4/component/authenticator/src/main/java/org/wso2/carbon/identity/authenticator/x509Certificate/X509CertificateUtil.java#L468