azure ad key-credential

testuser7 271

Hello

I have two quick question.

When we add a KeyCredential of type AsymmetricX509Cert in any application-object through graph-api,

Can I add just a public-key OR I have to add the full-x509 certificate ?

If latter is true, then do I have to add the whole chain of certificate OR just my own certificate without worrying about who signed it ?

Thanks.

1 answer

Cristian SPIRIDON 4,471 Reputation points

2022-08-13T04:33:16.667+00:00

Hi

Following post details what you need:

https://blogs.aaddevsup.xyz/2020/08/using-powershell-to-configure-a-signing-certificate-for-a-saml-based-sso-enterprise-application

You need both the cert file and the pfx.

Hope this helps
Please sign in to rate this answer.
testuser7 271 Reputation points

2022-08-13T12:28:52.503+00:00

Thanks @Cristian SPIRIDON

That blog was useful. one question, though.

If I want to make key-credential of type "X509CertAndPassword", do i have to send the corresponding public credential i.e., type = AsymmetricX509Cert in the SAME graph request ?

and secondly,
the blog explains with self-sign-cert.
If the app has got the cert from some certificate authority, then I believe I need to base64 the entire certificate-chain while putting in the graph call.
Am I correct ?

Thanks.

Cristian SPIRIDON 4,471 Reputation points

2022-08-13T16:20:01.417+00:00

Hi,

If you have a signed cert chain you need to send it all in the request.

And AsymetricX509Cert need to be sent in the SAME request.

Hope this helps!

testuser7 271 Reputation points

2022-08-15T13:57:05.57+00:00

Thanks @Cristian SPIRIDON

I think I got it. So just before wrapping up this thread, if I have a PFX file containing one cert-chain and the corresponding private-key, then I Can NOT upload the PFX file as is.

I need to first separate out the cert-chain and private-key through openSSL command
openssl pkcs12 -in filename.pfx -nocerts -out key.pem
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

and now I can invoke the graph api and input the output of key.pem and cert.pem to create 2 KeyCreds of type X509CertAndPassword and AsymetricX509Cert respectively.

Of course I will need payload for password-Cred also in the same graph-call.

Am I right ??

Thanks.

Cristian SPIRIDON 4,471 Reputation points

2022-08-15T14:08:27.787+00:00

Hi,

You are right. You need to send the public certs chain, the private key and the password in the same call.

Let me know if any issues.

testuser7 271 Reputation points

2022-08-15T15:50:33.54+00:00

sound good.. Thanks @Cristian SPIRIDON for validation.
Appreciate it !!!

Jaya Lakshmi Koduru 6 Reputation points Microsoft Employee

2022-09-07T19:04:45.747+00:00

Hello @testuser7 do you need additional assistance? Was the answer helpful? If it was, please accept it and complete the quality survey so that others can find a solution.
Sign in to comment