Skip to content
This repository has been archived by the owner on Dec 14, 2017. It is now read-only.

Authenticate method with certificate validates the certificate validity dates against UTC #659

Open
mirecg opened this issue Jun 5, 2016 · 1 comment
Labels

Comments

@mirecg
Copy link

mirecg commented Jun 5, 2016

Hi,

I've found a bug when authenticating with certificate right after it has been created.

I mean UserAccountService.Authenticate(TAccount account, X509Certificate2 certificate). There is a validation of validity dates (NotBefore, NotAfter) against UtcNow property, which is not correct, because NotBefore and NotAfter properties are in local time. So the user with a newly created certificated is not able to login when he is not in the UTC timezone.

if (!(certificate.NotBefore < UtcNow && UtcNow < certificate.NotAfter))
{
    Tracing.Error("[UserAccountService.Authenticate] failed -- invalid certificate dates");
    this.AddEvent(new InvalidCertificateEvent<TAccount> { Account = account, Certificate = certificate });
    return false;
}
@brockallen
Copy link
Owner

Submit a PR please to dev.

@brockallen brockallen added the bug label Aug 13, 2016
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

2 participants