What is the equivalent code for mutual auth in iOS? - ios

Question

I am trying to make an API call to a server that requires mutual auth.
Using NodeJS and the request library I am able to hit the API with the following code
var keyFile = '/Users/username/Documents/Certificates/example-key.pem';
var certificateFile = '/Users/username/Documents/Certificates/cert.pem';
var options = {
uri: 'https://myserver.com/apiOne',
key: fs.readFileSync(keyFile),
cert: fs.readFileSync(certificateFile),
headers: {
'Content-Type': 'application/json',
'Accept': 'application/json',
'Authorization': 'Basic ' + new Buffer(userId + ':' + password).toString('base64')
},
body: data //JSON body
};
request.postAsync(options)
.spread(function (response, body) {
res.status(200).json(JSON.parse(body));
})
.catch(function (err) {
res.status(400).send(err);
})
How do I make hit the same API from an iOS app?
I am using the following code, but there is no response from the server
func URLSession(session: NSURLSession, didReceiveChallenge challenge: NSURLAuthenticationChallenge, completionHandler: (NSURLSessionAuthChallengeDisposition, NSURLCredential!) -> Void) {
if challenge.protectionSpace.authenticationMethod == "NSURLAuthenticationMethodServerTrust" {
let credential = NSURLCredential(forTrust: challenge.protectionSpace.serverTrust)
What do the key and cert mean in the NodeJS code? How do I pass them in iOS?

Answer 1

First, you will need to convert you key and cert into a p12 file.
To do that run the following command
openssl pkcs12 -export -out new.p12 -inkey example-key.pem -in cert.pem
It will also prompt you to enter a password. Use the path of this created p12 and password in the following code
#pragma mark - Get Identity
- (SecIdentityRef)getIdentity {
SecIdentityRef identity = nil;
CFStringRef password = (__bridge CFStringRef)certPassword; //the password that you entered while creating the p12 file
const void *keys[] = { kSecImportExportPassphrase };
const void *values[] = { password };
CFDictionaryRef options = CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL);
NSData *certData = [NSData dataWithContentsOfFile:certFilePath]; //the path to the p12 file. You can get this from bundle
CFArrayRef items = CFArrayCreate(nil, 0, 0, nil);
OSStatus status = SecPKCS12Import((__bridge CFDataRef)(certData), options, &items);
CFRelease(options);
CFRelease(password);
if (status == errSecSuccess) {
NSLog(#"Success opening p12 certificate. Items: %ld", CFArrayGetCount(items));
CFDictionaryRef identityDict = CFArrayGetValueAtIndex(items, 0);
identity = (SecIdentityRef)CFDictionaryGetValue(identityDict, kSecImportItemIdentity);
} else {
NSLog(#"Error opening Certificate.");
}
return identity;
}
#pragma mark - Get Certificates
- (CFArrayRef)getCertificates:(SecIdentityRef) identity {
SecCertificateRef certificate = nil;
SecIdentityCopyCertificate(identity, &certificate);
SecCertificateRef certs[1] = { certificate };
CFArrayRef array = CFArrayCreate(NULL, (const void **) certs, 1, NULL);
return array;
}
- (void)URLSession:(NSURLSession *)session didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential *))completionHandler {
NSString *authMethod = challenge.protectionSpace.authenticationMethod;
NSLog(#"auth method %#", authMethod);
if ([authMethod isEqualToString:#"NSURLAuthenticationMethodServerTrust"] || [authMethod isEqualToString:#"NSURLAuthenticationMethodClientCertificate"]) {
SecIdentityRef identity = [self getIdentity]; // Go get a SecIdentityRef
CFArrayRef certs = [self getCertificates:identity]; // Get an array of certificates
NSArray *myArray = (__bridge NSArray *)certs;
NSURLCredential *newCredential = [NSURLCredential credentialWithIdentity:identity certificates:myArray persistence:NSURLCredentialPersistencePermanent];
[challenge.sender useCredential:newCredential forAuthenticationChallenge:challenge];
completionHandler(NSURLSessionAuthChallengeUseCredential, newCredential);
}
}