Client certificate authentication

Authenticate OpenID Connect clients in PowerShell Universal with an RSA certificate using a private_key_jwt assertion instead of a client secret.

OpenID Connect (OIDC) clients can authenticate to a provider with an RSA certificate instead of a client secret. PowerShell Universal creates a short-lived private_key_jwt assertion using PS256 when it redeems the authorization code.

Requirements

• The identity provider must support private_key_jwt client authentication.
• The certificate file must be a PFX that includes an RSA private key.
• The client registration at the identity provider must be configured for the certificate used by PowerShell Universal.

Configure OIDC

In the OIDC authentication editor under Secure > Authentication, provide the certificate path. Optionally provide its password. If the password value is the name of a PSU secret variable, PowerShell Universal resolves that secret at runtime.

The existing OIDC client-secret flow is unchanged. Configure either a client secret or a client certificate for the client authentication method required by your provider.

Use Set-PSUAuthenticationMethod to configure the same settings from PowerShell:

Set-PSUAuthenticationMethod -Type OIDC `
    -CallbackPath '/auth/signin-oidc' `
    -ClientId '00000000-0000-0000-0000-000000000000' `
    -Authority 'https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0' `
    -ClientCertificate 'C:\certificates\psu-oidc.pfx' `
    -ClientCertificatePassword 'PsuOidcCertificatePassword'

Keep the certificate file readable by the account that runs PowerShell Universal. Do not store a certificate password in plain text when a PSU secret variable is available.