Can user use certificate which private key is on AWS cloud HSM?

Logs and Network traces This is a question from https://github.com/Azure/azure-powershell/issues/14814 User stores certificate but private key on AWS cloud HSM. When user login with certificate thumbprint, the private key cannot be found. The track is below. Is it supported?

Which Version of MSAL are you using ?

Microsoft.Identity.Client.Extensions.Msal 2.16.6.0

Platform

netcore

What authentication flow has the issue?

• Desktop / Mobile
  • Interactive
  • Integrated Windows Auth
  • Username Password
  • Device code flow (browserless)
• Web App
  • Authorization code
  • OBO
• Daemon App
  • Service to Service calls

Other? - please describe;

Is this a new or existing app?

Repro

var your = (code) => here;

Expected behavior A clear and concise description of what you expected to happen (or code).

Actual behavior A clear and concise description of what happens, e.g. exception is thrown, UI freezes

Possible Solution

Additional context/ Logs / Screenshots

Message        : The certificate certificate does not have a private key. 
StackTrace     :    at Microsoft.Identity.Client.ConfidentialClientApplicationBuilder.WithCertificate(X509Certificate2 certificate)
                    at Azure.Identity.MsalConfidentialClient.<CreateClientAsync>d__6.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at System.Threading.Tasks.ValueTask`1.get_Result()
                    at Azure.Identity.MsalClientBase`1.<GetClientAsync>d__16.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Azure.Identity.MsalConfidentialClient.<AcquireTokenForClientAsync>d__7.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Azure.Identity.ClientCertificateCredential.<GetTokenAsync>d__22.MoveNext()
Exception      : Microsoft.Identity.Client.MsalClientException
InvocationInfo : {Connect-AzAccount}
Line           : Connect-AzAccount -ServicePrincipal -CertificateThumbprint $cert.ThumbPrint -ApplicationID $sp.ApplicationID -Tenant $TenantID
Position       : At line:1 char:1
                 + Connect-AzAccount -ServicePrincipal -CertificateThumbprint $cert.Thum ...
                 + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[bgavrilMS]

I’ll let @dingmeng-xue chime in for the operations available in PowerShell. Note that PowerShell’s Connect-AzAccount is a higher-level API over MSAL. MSAL is the identity SDK, but it is somewhat low-level.

Service principals, which can call Graph with app permissions, are part of the confidential client OAuth flows. Confidentiality is ensured by the fact that the machine making the call has a dedicated / confidential connection to the token issuer (AAD). So you should only deploy the cert onto server-side / back-end machines. User machines cannot ensure confidentiality.

If you want to explore using MSAL directly, which would allow you more control over the signing operations, please have a look at:

https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Client-credential-flows (there is a sample at the bottom of the page)

and for full control over the signing operation:

https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Client-Assertions#signed-assertions

[chadduffey]

Thanks for the detailed response @bgavrilMS. The challenge we are trying to solve is that its not really possible to ensure confidentiality even on a server machine without the HSM. With the HSM we can ensure that not even a machine admin could take the private key and use it outside of the environment. We’ll take a look at the options for taking full control of the signing operations.

Thanks again. We really appreciate your time.