Graph API: Listing the Active SAML signing certificates

user_11295751 0
Viewed 156

I am using Postman and the servicePrincipals API to build a list of our SAML signing certificates and their expirations. I have all of the keyCredentials for the appID as well as the preferredTokenSigningKeyThumbprint for the Active cert. However, I am not finding any API references to tie the active thumbprint to the keyCredentials.

Anyone figured out how to build the tie-ins?

Thanks

azure-service-principal microsoft-graph-api saml
1 Answers

According to the docs, the property keyCredentials will have the value you are looking for.

Key Credentials will have the following structure:

{
  "@odata.type": "#microsoft.graph.keyCredential",
  "customKeyIdentifier": "Binary",
  "displayName": "String",
  "endDateTime": "String (timestamp)",
  "key": "Binary",
  "keyId": "Guid",
  "startDateTime": "String (timestamp)",
  "type": "String",
  "usage": "String"
}

You can get the thumbprint directly when you call "addSelfSignedSigningCertificate" action, Microsoft doesn't provide the thumbprint in other calls. The closest you can get is to provide a 'customKeyIdentifier' or read back the key and derivative the thumbprint by taking the key data and feeding into a tool like openssl.

openssl pkey -in ~/keyfile -pubout -outform DER | openssl md5 -c

https://stackoverflow.com/a/42248153/5779200

user_57792000
Related