What is the purpose of the "Allow" option of the client certificate mode in an Azure App Service?

user_5341247 0
Viewed 2124

I'm trying to secure my Azure Web Application by adding a .pfx certificate.

In Azure portal I've added my pfx file: App Service -> TLS/SSL settings -> Private Key Certificates (.pfx) -> Upload Certificate

Then under the settings blade : Configuration -> General Settings -> Incoming client certificates -> Client certificate mode we have 3 options : Require, Allow and Ignore.

  • If I select Ignore I can navigate to my website wherever I have the certificate installed on my computer or not.
  • If I select Require I can navigate to my website only If I've the certificate installed on my computer.
  • If I select Allow this act like the Ignore option: I can navigate to my website wherever I have the certificate installed on my computer or not.

So what is the purpose of the Allow option? I didn't find any litterature about it.

enter image description here

azure-webapps azure certificate ssl-certificate
2 Answers

The "allow" option enables authentication to your app using both certificate and AAD token.

When choosing "allow" the app will request a certificate - by that enabling an authentication with it. But the app will also pass the request when no certificate was provided - by that enabling an authentication with a token.

Note that its the code responsibility to verify this token is valid with AAD (as it is to verify the certificate).

The other options:

  • "require" will block the request on the AppService level where no certificate was provided, so it doesn't enable using tokens.
  • "ignore" will not require a certificate at all, so it doesn't enable using certificates.

So "allow" solves this issue and allow the app to enable authentication with both.

Read more here: Documentation

user_103865760

Allow option means that the app will request a cert, but will not fail the request if no cert is presented. This is different from the Ignore in that the ignore options will not request for a cert in the first place.

user_7643920
Related