Azure AD upload service principals key credentials certificate

user_6232031 0
Viewed 392

I have a problem with the GraphAPI from Microsoft.

In the documentation I do not get further from point 4 on.
Link: Automate SAML-based SSO app configuration with Microsoft Graph API

My problem is:
In the documentation is "Extract the private and public key Base64 encoded from the PFX file".
I have tried many things but everything I have tried I always get a error.
I do not know how to upload a sign certificate.

The upload of a Verify certificate works without problems.

The error code von GraphAPI is:

Error: Code: Request_BadRequest
Message: The value for the property "usage" in one of your credentials is invalid. Acceptable values are Sign, Verify.

Do any of you have any idea what's wrong?

Thanks

azure-ad-graph-api .net-core azure c#
2 Answers

As the error shows, the value for the property usage uses Sign or Verify. And it is also noted in the link.

The "key" value in the keyCredentials property is shortened for readability. The value is base 64 encoded. For the private key the property usage is "Sign". For the public key the property usage is "Verify".

Check the property usage of keyCredentials.

"keyCredentials":[
        {
            "customKeyIdentifier": "lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=",
            "endDateTime": "2021-04-22T22:10:13Z",
            "keyId": "4c266507-3e74-4b91-aeba-18a25b450f6e",
            "startDateTime": "2020-04-22T21:50:13Z",
            "type": "AsymmetricX509Cert",
            "usage": "Sign",
            "key":"MIIKIAIBAz.....HBgUrDgMCERE20nuTptI9MEFCh2Ih2jaaLZBZGeZBRFVNXeZmAAgIH0A==",
            "displayName": "CN=awsAPI"
        }]
user_133083810

From my point of view, I am following exactly the documentation.
My JSON looks like:

{
  "keyCredentials": [
    {
      "customKeyIdentifier": "ZWxYN1pOc21Od3NJUU4rYjduTUNxclJ5emtrPQ==",
      "endDateTime": "2030-07-08T16:06:27+02:00",
      "keyId": "a3892889-b097-4c36-ac69-5fb3d18d2396",
      "startDateTime": "2020-07-09T16:06:27+02:00",
      "type": "AsymmetricX509Cert",
      "usage": "Sign",
      "key": "MIIC1TCCAb2gAwIBAgIIK2yf8UkTD3swDQYJKoZIhvcNAQELBQAwETEPMA0GA1UEAxMGYXdzQVBJMB4XDTIwMDcwOTE0MDYyN1oXDTMwMDcwODE0MDYyN1owETEPMA0GA1UEAxMGYXdzQVBJMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnF4Ue9mB3nhueo+L/ZxPr1GmO/Iqx2upXdwBm7xZFwZ59rV2MSb66RZXOaUQlqERQjfmbdADwmNN4XWSk6oR7h8LFz8/+LLf2ZVVJbq6mnuTtLX11uGpKi6dpObMC0nqDLu/hwApcjSiMS8VtdP9QyJNtydE4+T0aXGDOL34ZDRlxKY+1uy1w3KI6ZFYib7c4/cJ1+PDr9YdC4hu8dus6fzVRE9v63Rg/CjiHIXaWiaOcftw5wOh9rS4qtvrI+u+muIYQrvkR+Ex1aAwKo/T5aDnj/kHRXsNV1qpZxT1cqtJNON3feYD7Il8lkXOuBPdPVccsNLvAgHfiEYUwnFE+QIDAQABozEwLzALBgNVHQ8EBAMCBaAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQAjpVAJOwl1gN22hNm98cw0+a1o+m1W4jp9WPe2Qovhu8wvY22xPwPL53iZuPFLe+4aHGIgdO4GXPt19xGH1qZAhITLzeUillCnMvx55ufLOYB95J4V8r8cfT7IO2OYpeHe4kiUCeDNt80F62PLVopONdf7Z9ULrSG8gX6GSVDPz6kqK2t7fAre9ppjkUfQOwtY+ybwtao7Awa9+xafvVz1LGZubuUESXOozeY0SRezOlUaJd5h94vHXKMk8ZmtUZaOXnujfGcZKErkEmgNhtBoc4OtDkAZpDXfDlOrY+Tea8eOejiz9+O4WNsYOXoZ2TLS3YY6IFKDsRj+M3sm7A87",
      "displayName": "CN=awsAPI",
      "@odata.type": "microsoft.graph.keyCredential"
    },
    {
      "customKeyIdentifier": "ZWxYN1pOc21Od3NJUU4rYjduTUNxclJ5emtrPQ==",
      "endDateTime": "2030-07-08T16:06:27+02:00",
      "keyId": "b022f959-3f36-4880-8537-265f62ba9df0",
      "startDateTime": "2020-07-09T16:06:27+02:00",
      "type": "AsymmetricX509Cert",
      "usage": "Verify",
      "key": "MIIC1TCCAb2gAwIBAgIIK2yf8UkTD3swDQYJKoZIhvcNAQELBQAwETEPMA0GA1UEAxMGYXdzQVBJMB4XDTIwMDcwOTE0MDYyN1oXDTMwMDcwODE0MDYyN1owETEPMA0GA1UEAxMGYXdzQVBJMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnF4Ue9mB3nhueo+L/ZxPr1GmO/Iqx2upXdwBm7xZFwZ59rV2MSb66RZXOaUQlqERQjfmbdADwmNN4XWSk6oR7h8LFz8/+LLf2ZVVJbq6mnuTtLX11uGpKi6dpObMC0nqDLu/hwApcjSiMS8VtdP9QyJNtydE4+T0aXGDOL34ZDRlxKY+1uy1w3KI6ZFYib7c4/cJ1+PDr9YdC4hu8dus6fzVRE9v63Rg/CjiHIXaWiaOcftw5wOh9rS4qtvrI+u+muIYQrvkR+Ex1aAwKo/T5aDnj/kHRXsNV1qpZxT1cqtJNON3feYD7Il8lkXOuBPdPVccsNLvAgHfiEYUwnFE+QIDAQABozEwLzALBgNVHQ8EBAMCBaAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQAjpVAJOwl1gN22hNm98cw0+a1o+m1W4jp9WPe2Qovhu8wvY22xPwPL53iZuPFLe+4aHGIgdO4GXPt19xGH1qZAhITLzeUillCnMvx55ufLOYB95J4V8r8cfT7IO2OYpeHe4kiUCeDNt80F62PLVopONdf7Z9ULrSG8gX6GSVDPz6kqK2t7fAre9ppjkUfQOwtY+ybwtao7Awa9+xafvVz1LGZubuUESXOozeY0SRezOlUaJd5h94vHXKMk8ZmtUZaOXnujfGcZKErkEmgNhtBoc4OtDkAZpDXfDlOrY+Tea8eOejiz9+O4WNsYOXoZ2TLS3YY6IFKDsRj+M3sm7A87",
      "displayName": "CN=awsAPI",
      "@odata.type": "microsoft.graph.keyCredential"
    }
  ],
  "@odata.type": "microsoft.graph.servicePrincipal"
}

As you can see, I use the values Sign and Verify for the property of "usage"

Error: Code: Request_BadRequest
Message: The value for the property "usage" in one of your credentials is invalid. Acceptable values are Sign, Verify.

To reproduce the error above I left the keys unshortened

user_62320310
Related