Uploading a x509 cert to Application Manifest on Azure ADD or Microsoft Registration Portal

Question

Sorry for the multiple post about the same issue!

I'm trying to upload a self signed sertificate to application manifest created on Microsoft Registration Portal but I have some issues which I don't completly understand why, According to this answer, it's very much possible to upload the certificate using DELEGATED PERMISSIONS however I don't see the reason why I can't use Application Permissions since I only need the AccessToken and I get that with the client_credential grant flow,

Below is the code that I have tried but when retrieving the token with client_credential grant flow, I get stuck att var application = activeDirectoryClient.Applications["ApplicationObjectId"].ExecuteAsync().Result;

and when trying to use the code given to my by Tom Sung in the previous post, the applications exits with error "must have client_credentil or client_assertion in request body"

this is the code that I have tried:

 private static async Task<string> GetAppTokenAsync(string graphResourceId, string tenantId, string clientId, string userId)
    {

        string aadInstance = "https://login.microsoftonline.com/" + tenantId + "/oauth2/token";
        var clientCredential = new ClientCredential(clientId, clientSecret);
        AuthenticationContext authenticationContextt =
            new AuthenticationContext($"https://login.microsoftonline.com/{tenantId}/oauth2/token");
        AuthenticationResult result =
            await authenticationContextt.AcquireTokenAsync(graphResourceId,
                clientCredential);
        //token is acquiered and gets stuck 
        var e = result.AccessToken;


        //Tom Suns code
        IPlatformParameters parameters = new PlatformParameters(PromptBehavior.SelectAccount);
        AuthenticationContext authenticationContext = new AuthenticationContext(aadInstance);
        var authenticationResult = await authenticationContext.AcquireTokenAsync(graphResourceId, clientId, new Uri("http://localhost"), parameters, new UserIdentifier(userId, UserIdentifierType.UniqueId));
        //exits with error
        return authenticationResult.AccessToken;
    }


try
 {          
    var graphResourceId = "https://graph.windows.net";
    var userId = "****";
    //used to test if token is acquired
    //var tokennn = await GetAppTokenAsync(graphResourceId, tenantID, ClientId, userId);
    var servicePointUri = new Uri(graphResourceId);
    var serviceRoot = new Uri(servicePointUri, tenant);
    var activeDirectoryClient = new ActiveDirectoryClient(serviceRoot, async () => await GetAppTokenAsync(graphResourceId, tenantID, ClientId, userId));
    AsymmetricKeyParameter myCAprivateKey = null;
    //generate a root CA cert and obtain the privateKey
    X509Certificate2 MyRootCAcert = CreateCertificateAuthorityCertificate("CN=OutlookIntegration", out myCAprivateKey);
    //add CA cert to store
    addCertToStore(MyRootCAcert, StoreName.Root, StoreLocation.LocalMachine);
    var expirationDate = DateTime.Parse(MyRootCAcert.GetExpirationDateString()).ToUniversalTime();
    var startDate = DateTime.Parse(MyRootCAcert.GetEffectiveDateString()).ToUniversalTime();
    var binCert = MyRootCAcert.GetRawCertData();
    var keyCredential = new KeyCredential
        {
           CustomKeyIdentifier = MyRootCAcert.GetCertHash(),
           EndDate = expirationDate,
           KeyId = Guid.NewGuid(),
           StartDate = startDate,
           Type = "AsymmetricX509Cert",
           Usage = "Verify",
           Value = binCert
         };
     //gets stuck here when using clientsecret grant type
     var application = activeDirectoryClient.Applications["ApplicationObjectId"].ExecuteAsync().Result;
                application.KeyCredentials.Add(keyCredential);
                application.UpdateAsync().Wait();
}
catch (Exception exception)
{
   Console.WriteLine(exception);
   throw;
}

I am now completly stuck, Anyone have any idea why it doesn't work with Application Permissions or why it gets stuck at var application = activeDirectoryClient.Applications["ApplicationObjectId"].ExecuteAsync().Result;

Edit 1 is it because I have my app as a web app/API that uses username and password to authenticate?

score 1 · Answer 1 · answered Jul 10 '18 at 08:39

1

Based on my test if we want to change the keyCredential, DELEGATED PERMISSIONS is required.

If we want to update Azure AD application other properties, we could use Application Permissions.

Reference:

Azure Active Directory developer glossary

"Delegated" permissions, which specify scope-based access using delegated authorization from the signed-in resource owner, are presented to the resource at run-time as "scp" claims in the client's access token.
"Application" permissions, which specify role-based access using the client application's credentials/identity, are presented to the resource at run-time as "roles" claims in the client's access token.

answered Jul 10 '18 at 08:39

Tom Sun - MSFT

24,161
3
30
47

ah, but I'm the global admin of my own domain so I should at least be appble to fetch the applications by objectID or applicationID, However both return `{ "error": { "code": "BadRequest", "message": "Invalid version", "innerError": { "request-id": "1ab1aaba-*", "date": "2018-07-10T09:55:23" } } }` – Ako Jul 10 '18 at 10:00
I have the same package.config as yours with the same versions – Ako Jul 10 '18 at 10:03

Uploading a x509 cert to Application Manifest on Azure ADD or Microsoft Registration Portal

1 Answers1