Configurar el inicio de sesión único basado en SAML para su aplicación con la API de Microsoft Graph

Artículo
03/09/2023

En este artículo, aprenderá a crear y configurar un inicio de sesión único basado en SAML (SSO) para su aplicación en Azure Active Directory (Azure AD) mediante la API de Microsoft Graph. La configuración de la aplicación incluye direcciones URL SAML básicas, una directiva de asignación de notificaciones y un certificado para agregar una clave de firma personalizada. Una vez creada la aplicación, debe asignarle un usuario para que haga de administrador. Después, puede usar una dirección URL para obtener metadatos de Azure AD SAML para la configuración adicional de la aplicación.

El presente artículo usa una plantilla de aplicación AWS Azure AD como ejemplo, pero puede usar estos pasos para cualquier aplicación basada en SAML en la galería de Azure AD.

Requisitos previos

Inicie sesión en un cliente de API como Graph Explorer, Postman o cree su propia aplicación cliente para llamar a Microsoft Graph. Para llamar a las API de Microsoft Graph en este tutorial, debe usar una cuenta con el rol de administrador global.
Concédese los siguientes permisos delegados: Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, Policy.Read.All, Policy.ReadWrite.ApplicationConfigurationy User.ReadWrite.All.

Paso 1: Crear la aplicación

Azure AD tiene una galería con miles de aplicaciones integradas que puede usar como plantilla para la aplicación. La plantilla de la aplicación describe los metadatos de esa aplicación. Con esta plantilla, puede crear una instancia de la aplicación y de la entidad de servicio en su espacio empresarial para administrarlas.

Para crear la aplicación desde la galería, primero obtenga el identificador de la plantilla de aplicación y, después, use ese identificador para crear la aplicación.

Recupere el identificador de plantilla de la aplicación de la galería

En este tutorial, recuperará el identificador de la plantilla de la aplicación para AWS IAM Identity Center (successor to AWS Single Sign-On). A continuación, registre el valor de la propiedad id para usarlo más adelante en este tutorial.

Solicitud

GET https://graph.microsoft.com/v1.0/applicationTemplates?$filter=displayName eq 'AWS IAM Identity Center (successor to AWS Single Sign-On)'


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var result = await graphClient.ApplicationTemplates.GetAsync((requestConfiguration) =>
{
	requestConfiguration.QueryParameters.Filter = "displayName eq 'AWS IAM Identity Center '";
});



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphconfig "github.com/microsoftgraph/msgraph-sdk-go/applicationtemplates"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)



requestFilter := "displayName eq 'AWS IAM Identity Center '"

requestParameters := &graphconfig.ApplicationTemplatesRequestBuilderGetQueryParameters{
	Filter: &requestFilter,
}
configuration := &graphconfig.ApplicationTemplatesRequestBuilderGetRequestConfiguration{
	QueryParameters: requestParameters,
}

result, err := graphClient.ApplicationTemplates().Get(context.Background(), configuration)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

ApplicationTemplateCollectionPage applicationTemplates = graphClient.applicationTemplates()
	.buildRequest()
	.filter("displayName eq 'AWS IAM Identity Center (successor to AWS Single Sign-On)'")
	.get();


const options = {
	authProvider,
};

const client = Client.init(options);

let applicationTemplates = await client.api('/applicationTemplates')
	.filter('displayName eq \'AWS IAM Identity Center (successor to AWS Single Sign-On)\'')
	.get();


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestConfiguration = new ApplicationTemplatesRequestBuilderGetRequestConfiguration();
$queryParameters = ApplicationTemplatesRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->filter = "displayName eq 'AWS IAM Identity Center '";
$requestConfiguration->queryParameters = $queryParameters;


$result = $graphServiceClient->applicationTemplates()->get($requestConfiguration);


Import-Module Microsoft.Graph.Applications

Get-MgApplicationTemplate -Filter "displayName eq 'AWS IAM Identity Center (successor to AWS Single Sign-On)'"

Respuesta

HTTP/1.1 200 OK
Content-type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#applicationTemplates",
    "value": [
        {
            "id": "21ed01d2-ec13-4e9e-86c1-cd546719ebc4",
            "displayName": "AWS IAM Identity Center (successor to AWS Single Sign-On)",
            "homePageUrl": "https://aws.amazon.com/",
            "supportedSingleSignOnModes": [
                "saml",
                "external"
            ],
            "supportedProvisioningTypes": [
                "sync"
            ],
            "logoUrl": "https://az495088.vo.msecnd.net/app-logo/awssinglesignon_215.png",
            "categories": [
                "developerServices",
                "itInfrastructure",
                "security",
                "New"
            ],
            "publisher": "Amazon Web Services, Inc.",
            "description": "Federate once to AWS IAM Identity Center (successor to AWS Single Sign-On) & use it to centrally manage access to multiple AWS accounts and IAM Identity Center enabled apps. Provision users via SCIM."
        }
    ]
}

Crear la aplicación

Con el id. que agregó para la plantilla de la aplicación, cree una instancia de la entidad de servicio y la aplicación en su espacio empresarial. Registre el valor de la propiedad Id de la aplicación y el valor de la propiedad Id de la entidad de servicio.para ser usados más adelante,

Solicitud

POST https://graph.microsoft.com/v1.0/applicationTemplates/21ed01d2-ec13-4e9e-86c1-cd546719ebc4/instantiate
Content-type: application/json

{
  "displayName": "AWS Contoso"
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new Microsoft.Graph.ApplicationTemplates.Item.Instantiate.InstantiatePostRequestBody
{
	DisplayName = "AWS Contoso",
};
var result = await graphClient.ApplicationTemplates["{applicationTemplate-id}"].Instantiate.PostAsync(requestBody);



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/ApplicationTemplates/Item/Instantiate"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewInstantiatePostRequestBody()
displayName := "AWS Contoso"
requestBody.SetDisplayName(&displayName) 

result, err := graphClient.ApplicationTemplates().ByApplicationTemplateId("applicationTemplate-id").Instantiate().Post(context.Background(), requestBody, nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

String displayName = "AWS Contoso";

graphClient.applicationTemplates("21ed01d2-ec13-4e9e-86c1-cd546719ebc4")
	.instantiate(ApplicationTemplateInstantiateParameterSet
		.newBuilder()
		.withDisplayName(displayName)
		.build())
	.buildRequest()
	.post();


const options = {
	authProvider,
};

const client = Client.init(options);

const applicationServicePrincipal = {
  displayName: 'AWS Contoso'
};

await client.api('/applicationTemplates/21ed01d2-ec13-4e9e-86c1-cd546719ebc4/instantiate')
	.post(applicationServicePrincipal);


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new InstantiatePostRequestBody();
$requestBody->setDisplayName('AWS Contoso');



$result = $graphServiceClient->applicationTemplates()->byApplicationTemplateId('applicationTemplate-id')->instantiate()->post($requestBody);


Import-Module Microsoft.Graph.Applications

$params = @{
	displayName = "AWS Contoso"
}

Invoke-MgInstantiateApplicationTemplate -ApplicationTemplateId $applicationTemplateId -BodyParameter $params

Nota:

Dé un margen de tiempo para que se aprovisione la aplicación en su inquilino de Azure AD. No sucede de manera instantánea. Una estrategia puede ser realizar una consulta GET en la aplicación o en el objeto de la entidad de servicio cada 5-10 segundos hasta que la consulta se realice correctamente.

Respuesta

HTTP/1.1 201 Created
Content-type: application/json

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.applicationServicePrincipal",
  "application": {
    "id": "a9be408a-6c31-4141-8cea-52fcd4a61be8",
    "appId": "17cad0e7-cd2b-4e51-a75d-ba810f3e4045",
    "applicationTemplateId": "21ed01d2-ec13-4e9e-86c1-cd546719ebc4",
    "createdDateTime": "2021-05-10T20:12:03Z",
    "deletedDateTime": null,
    "displayName": "AWS Contoso",
    "groupMembershipClaims": null,
    "identifierUris": [],
    "isFallbackPublicClient": false,
    "signInAudience": "AzureADMyOrg",
    "tags": [],
    "tokenEncryptionKeyId": null,
    "defaultRedirectUri": null,
    "optionalClaims": null,
    "verifiedPublisher": {
      "displayName": null,
      "verifiedPublisherId": null,
      "addedDateTime": null
    },
    "addIns": [],
    "api": {
      "acceptMappedClaims": null,
      "knownClientApplications": [],
      "requestedAccessTokenVersion": null,
      "oauth2PermissionScopes": [
        {
          "adminConsentDescription": "Allow the application to access AWS Contoso on behalf of the signed-in user.",
          "adminConsentDisplayName": "Access AWS Contoso",
          "id": "6f891cd3-c132-4822-930b-f343b4515d19",
          "isEnabled": true,
          "type": "User",
          "userConsentDescription": "Allow the application to access AWS Contoso on your behalf.",
          "userConsentDisplayName": "Access AWS Contoso",
          "value": "user_impersonation"
        }
      ],
      "preAuthorizedApplications": []
    },
    "appRoles": [
      {
        "allowedMemberTypes": [
          "User"
        ],
        "displayName": "User",
        "id": "8774f594-1d59-4279-b9d9-59ef09a23530",
        "isEnabled": true,
        "description": "User",
        "value": null,
        "origin": "Application"
      },
      {
        "allowedMemberTypes": [
          "User"
        ],
        "displayName": "msiam_access",
        "id": "e7f1a7f3-9eda-48e0-9963-bd67bf531afd",
        "isEnabled": true,
        "description": "msiam_access",
        "value": null,
        "origin": "Application"
      }
    ],
    "info": {
      "logoUrl": null,
      "marketingUrl": null,
      "privacyStatementUrl": null,
      "supportUrl": null,
      "termsOfServiceUrl": null
    },
    "keyCredentials": [],
    "parentalControlSettings": {
      "countriesBlockedForMinors": [],
      "legalAgeGroupRule": "Allow"
    },
    "passwordCredentials": [],
    "publicClient": {
      "redirectUris": []
    },
    "requiredResourceAccess": [],
    "web": {
      "homePageUrl": "https://*.signin.aws.amazon.com/platform/saml/acs/*?metadata=awssinglesignon|ISV9.1|primary|z",
      "redirectUris": []
    }
  },
  "servicePrincipal": {
    "id": "a750f6cf-2319-464a-bcc3-456926736a91",
    "deletedDateTime": null,
    "accountEnabled": true,
    "appId": "17cad0e7-cd2b-4e51-a75d-ba810f3e4045",
    "applicationTemplateId": "21ed01d2-ec13-4e9e-86c1-cd546719ebc4",
    "appDisplayName": "AWS Contoso",
    "alternativeNames": [],
    "appOwnerOrganizationId": "8500cad3-193d-48a6-8d00-c129b114dc10",
    "displayName": "AWS Contoso",
    "appRoleAssignmentRequired": true,
    "loginUrl": null,
    "logoutUrl": null,
    "homepage": "https://*.signin.aws.amazon.com/platform/saml/acs/*?metadata=awssinglesignon|ISV9.1|primary|z",
    "notificationEmailAddresses": [],
    "preferredSingleSignOnMode": null,
    "preferredTokenSigningKeyThumbprint": null,
    "replyUrls": [],
    "servicePrincipalNames": [
      "17cad0e7-cd2b-4e51-a75d-ba810f3e4045"
    ],
    "servicePrincipalType": "Application",
    "tags": [
      "WindowsAzureActiveDirectoryIntegratedApp"
    ],
    "tokenEncryptionKeyId": null,
    "samlSingleSignOnSettings": null,
    "verifiedPublisher": {
      "displayName": null,
      "verifiedPublisherId": null,
      "addedDateTime": null
    },
    "addIns": [],
    "appRoles": [
      {
        "allowedMemberTypes": [
          "User"
        ],
        "displayName": "User",
        "id": "8774f594-1d59-4279-b9d9-59ef09a23530",
        "isEnabled": true,
        "description": "User",
        "value": null,
        "origin": "Application"
      },
      {
        "allowedMemberTypes": [
          "User"
        ],
        "displayName": "msiam_access",
        "id": "e7f1a7f3-9eda-48e0-9963-bd67bf531afd",
        "isEnabled": true,
        "description": "msiam_access",
        "value": null,
        "origin": "Application"
      }
    ],
    "info": {
      "logoUrl": null,
      "marketingUrl": null,
      "privacyStatementUrl": null,
      "supportUrl": null,
      "termsOfServiceUrl": null
    },
    "keyCredentials": [],
    "oauth2PermissionScopes": [
      {
        "adminConsentDescription": "Allow the application to access AWS Contoso on behalf of the signed-in user.",
        "adminConsentDisplayName": "Access AWS Contoso",
        "id": "6f891cd3-c132-4822-930b-f343b4515d19",
        "isEnabled": true,
        "type": "User",
        "userConsentDescription": "Allow the application to access AWS Contoso on your behalf.",
        "userConsentDisplayName": "Access AWS Contoso",
        "value": "user_impersonation"
      }
    ],
    "passwordCredentials": []
  }
}

Paso 2: Configurar el inicio de sesión único

En este tutorial, establecerá saml como el inicio de sesión único en la entidad de servicio. Use el Id para la entidad de servicio que agregó anteriormente.

Solicitud

PATCH https://graph.microsoft.com/v1.0/servicePrincipals/a750f6cf-2319-464a-bcc3-456926736a91
Content-type: application/json

{
  "preferredSingleSignOnMode": "saml"
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new ServicePrincipal
{
	PreferredSingleSignOnMode = "saml",
};
var result = await graphClient.ServicePrincipals["{servicePrincipal-id}"].PatchAsync(requestBody);



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewServicePrincipal()
preferredSingleSignOnMode := "saml"
requestBody.SetPreferredSingleSignOnMode(&preferredSingleSignOnMode) 

result, err := graphClient.ServicePrincipals().ByServicePrincipalId("servicePrincipal-id").Patch(context.Background(), requestBody, nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

ServicePrincipal servicePrincipal = new ServicePrincipal();
servicePrincipal.preferredSingleSignOnMode = "saml";

graphClient.servicePrincipals("a750f6cf-2319-464a-bcc3-456926736a91")
	.buildRequest()
	.patch(servicePrincipal);


const options = {
	authProvider,
};

const client = Client.init(options);

const servicePrincipal = {
  preferredSingleSignOnMode: 'saml'
};

await client.api('/servicePrincipals/a750f6cf-2319-464a-bcc3-456926736a91')
	.update(servicePrincipal);


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new ServicePrincipal();
$requestBody->setPreferredSingleSignOnMode('saml');



$result = $graphServiceClient->servicePrincipals()->byServicePrincipalId('servicePrincipal-id')->patch($requestBody);


Import-Module Microsoft.Graph.Applications

$params = @{
	preferredSingleSignOnMode = "saml"
}

Update-MgServicePrincipal -ServicePrincipalId $servicePrincipalId -BodyParameter $params

Respuesta

HTTP/1.1 204 No Content

Establecer direcciones URL de SAML básicas

Use el Id para la aplicación que registró anteriormente para establecer el identificador URI y redirija el identificador URI de AWS en el objeto de aplicación.

Solicitud

PATCH https://graph.microsoft.com/v1.0/applications/a9be408a-6c31-4141-8cea-52fcd4a61be8
Content-type: application/json

{
  "web": {
    "redirectUris": [
      "https://signin.aws.amazon.com/saml"
    ] 
  },
  "identifierUris": [
    "https://signin.aws.amazon.com/saml"
  ]    
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new Application
{
	Web = new WebApplication
	{
		RedirectUris = new List<string>
		{
			"https://signin.aws.amazon.com/saml",
		},
	},
	IdentifierUris = new List<string>
	{
		"https://signin.aws.amazon.com/saml",
	},
};
var result = await graphClient.Applications["{application-id}"].PatchAsync(requestBody);



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewApplication()
web := graphmodels.NewWebApplication()
redirectUris := []string {
	"https://signin.aws.amazon.com/saml",

}
web.SetRedirectUris(redirectUris)
requestBody.SetWeb(web)
identifierUris := []string {
	"https://signin.aws.amazon.com/saml",

}
requestBody.SetIdentifierUris(identifierUris)

result, err := graphClient.Applications().ByApplicationId("application-id").Patch(context.Background(), requestBody, nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

Application application = new Application();
WebApplication web = new WebApplication();
LinkedList<String> redirectUrisList = new LinkedList<String>();
redirectUrisList.add("https://signin.aws.amazon.com/saml");
web.redirectUris = redirectUrisList;
application.web = web;
LinkedList<String> identifierUrisList = new LinkedList<String>();
identifierUrisList.add("https://signin.aws.amazon.com/saml");
application.identifierUris = identifierUrisList;

graphClient.applications("a9be408a-6c31-4141-8cea-52fcd4a61be8")
	.buildRequest()
	.patch(application);


const options = {
	authProvider,
};

const client = Client.init(options);

const application = {
  web: {
    redirectUris: [
      'https://signin.aws.amazon.com/saml'
    ] 
  },
  identifierUris: [
    'https://signin.aws.amazon.com/saml'
  ]    
};

await client.api('/applications/a9be408a-6c31-4141-8cea-52fcd4a61be8')
	.update(application);


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new Application();
$web = new WebApplication();
$web->setRedirectUris(['https://signin.aws.amazon.com/saml', ]);


$requestBody->setWeb($web);
$requestBody->setIdentifierUris(['https://signin.aws.amazon.com/saml', ]);



$result = $graphServiceClient->applications()->byApplicationId('application-id')->patch($requestBody);


Import-Module Microsoft.Graph.Applications

$params = @{
	web = @{
		redirectUris = @(
			"https://signin.aws.amazon.com/saml"
		)
	}
	identifierUris = @(
		"https://signin.aws.amazon.com/saml"
	)
}

Update-MgApplication -ApplicationId $applicationId -BodyParameter $params

Respuesta

HTTP/1.1 204 No Content

Agregar roles de aplicación (opcional)

Si la aplicación requiere la información del rol en el token, agregue la definición de los roles en el objeto de aplicación.

Nota:

Al agregar roles de aplicación, no modifique los roles de aplicación predeterminados msiam_access.

Use el Id para la entidad de servicio que agregó anteriormente.

Solicitud

PATCH https://graph.microsoft.com/v1.0/serviceprincipals/a750f6cf-2319-464a-bcc3-456926736a91
Content-type: application/json

{
  "appRoles": [
    {
      "allowedMemberTypes": [
        "User"
      ],
      "displayName": "User",
      "id": "8774f594-1d59-4279-b9d9-59ef09a23530",
      "isEnabled": true,
      "description": "User",
      "value": null,
      "origin": "Application"
    },
    {
      "allowedMemberTypes": [
        "User"
      ],
      "displayName": "msiam_access",
      "id": "e7f1a7f3-9eda-48e0-9963-bd67bf531afd",
      "isEnabled": true,
      "description": "msiam_access",
      "value": null,
      "origin": "Application"
    },
    {
      "allowedMemberTypes": [
        "User"
      ],
      "description": "Admin,WAAD",
      "displayName": "Admin,WAAD",
      "id": "3a84e31e-bffa-470f-b9e6-754a61e4dc63",
      "isEnabled": true,
      "value": "arn:aws:iam::212743507312:role/accountname-aws-admin,arn:aws:iam::212743507312:saml-provider/WAAD"
    },
    {
      "allowedMemberTypes": [
        "User"
      ],
      "description": "Finance,WAAD",
      "displayName": "Finance,WAAD",
      "id": "7a960000-ded3-455b-8c04-4f2ace00319b",
      "isEnabled": true,
      "value": "arn:aws:iam::212743507312:role/accountname-aws-finance,arn:aws:iam::212743507312:saml-provider/WAAD"
    }
  ]
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new ServicePrincipal
{
	AppRoles = new List<AppRole>
	{
		new AppRole
		{
			AllowedMemberTypes = new List<string>
			{
				"User",
			},
			DisplayName = "User",
			Id = Guid.Parse("8774f594-1d59-4279-b9d9-59ef09a23530"),
			IsEnabled = true,
			Description = "User",
			Value = null,
			Origin = "Application",
		},
		new AppRole
		{
			AllowedMemberTypes = new List<string>
			{
				"User",
			},
			DisplayName = "msiam_access",
			Id = Guid.Parse("e7f1a7f3-9eda-48e0-9963-bd67bf531afd"),
			IsEnabled = true,
			Description = "msiam_access",
			Value = null,
			Origin = "Application",
		},
		new AppRole
		{
			AllowedMemberTypes = new List<string>
			{
				"User",
			},
			Description = "Admin,WAAD",
			DisplayName = "Admin,WAAD",
			Id = Guid.Parse("3a84e31e-bffa-470f-b9e6-754a61e4dc63"),
			IsEnabled = true,
			Value = "arn:aws:iam::212743507312:role/accountname-aws-admin,arn:aws:iam::212743507312:saml-provider/WAAD",
		},
		new AppRole
		{
			AllowedMemberTypes = new List<string>
			{
				"User",
			},
			Description = "Finance,WAAD",
			DisplayName = "Finance,WAAD",
			Id = Guid.Parse("7a960000-ded3-455b-8c04-4f2ace00319b"),
			IsEnabled = true,
			Value = "arn:aws:iam::212743507312:role/accountname-aws-finance,arn:aws:iam::212743507312:saml-provider/WAAD",
		},
	},
};
var result = await graphClient.ServicePrincipals["{servicePrincipal-id}"].PatchAsync(requestBody);



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewServicePrincipal()


appRole := graphmodels.NewAppRole()
allowedMemberTypes := []string {
	"User",

}
appRole.SetAllowedMemberTypes(allowedMemberTypes)
displayName := "User"
appRole.SetDisplayName(&displayName) 
id := uuid.MustParse("8774f594-1d59-4279-b9d9-59ef09a23530")
appRole.SetId(&id) 
isEnabled := true
appRole.SetIsEnabled(&isEnabled) 
description := "User"
appRole.SetDescription(&description) 
value := null
appRole.SetValue(&value) 
origin := "Application"
appRole.SetOrigin(&origin) 
appRole1 := graphmodels.NewAppRole()
allowedMemberTypes := []string {
	"User",

}
appRole1.SetAllowedMemberTypes(allowedMemberTypes)
displayName := "msiam_access"
appRole1.SetDisplayName(&displayName) 
id := uuid.MustParse("e7f1a7f3-9eda-48e0-9963-bd67bf531afd")
appRole1.SetId(&id) 
isEnabled := true
appRole1.SetIsEnabled(&isEnabled) 
description := "msiam_access"
appRole1.SetDescription(&description) 
value := null
appRole1.SetValue(&value) 
origin := "Application"
appRole1.SetOrigin(&origin) 
appRole2 := graphmodels.NewAppRole()
allowedMemberTypes := []string {
	"User",

}
appRole2.SetAllowedMemberTypes(allowedMemberTypes)
description := "Admin,WAAD"
appRole2.SetDescription(&description) 
displayName := "Admin,WAAD"
appRole2.SetDisplayName(&displayName) 
id := uuid.MustParse("3a84e31e-bffa-470f-b9e6-754a61e4dc63")
appRole2.SetId(&id) 
isEnabled := true
appRole2.SetIsEnabled(&isEnabled) 
value := "arn:aws:iam::212743507312:role/accountname-aws-admin,arn:aws:iam::212743507312:saml-provider/WAAD"
appRole2.SetValue(&value) 
appRole3 := graphmodels.NewAppRole()
allowedMemberTypes := []string {
	"User",

}
appRole3.SetAllowedMemberTypes(allowedMemberTypes)
description := "Finance,WAAD"
appRole3.SetDescription(&description) 
displayName := "Finance,WAAD"
appRole3.SetDisplayName(&displayName) 
id := uuid.MustParse("7a960000-ded3-455b-8c04-4f2ace00319b")
appRole3.SetId(&id) 
isEnabled := true
appRole3.SetIsEnabled(&isEnabled) 
value := "arn:aws:iam::212743507312:role/accountname-aws-finance,arn:aws:iam::212743507312:saml-provider/WAAD"
appRole3.SetValue(&value) 

appRoles := []graphmodels.AppRoleable {
	appRole,
	appRole1,
	appRole2,
	appRole3,

}
requestBody.SetAppRoles(appRoles)

result, err := graphClient.ServicePrincipals().ByServicePrincipalId("servicePrincipal-id").Patch(context.Background(), requestBody, nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

ServicePrincipal servicePrincipal = new ServicePrincipal();
LinkedList<AppRole> appRolesList = new LinkedList<AppRole>();
AppRole appRoles = new AppRole();
LinkedList<String> allowedMemberTypesList = new LinkedList<String>();
allowedMemberTypesList.add("User");
appRoles.allowedMemberTypes = allowedMemberTypesList;
appRoles.displayName = "User";
appRoles.id = UUID.fromString("8774f594-1d59-4279-b9d9-59ef09a23530");
appRoles.isEnabled = true;
appRoles.description = "User";
appRoles.value = null;
appRoles.origin = "Application";
appRolesList.add(appRoles);
AppRole appRoles1 = new AppRole();
LinkedList<String> allowedMemberTypesList1 = new LinkedList<String>();
allowedMemberTypesList1.add("User");
appRoles1.allowedMemberTypes = allowedMemberTypesList1;
appRoles1.displayName = "msiam_access";
appRoles1.id = UUID.fromString("e7f1a7f3-9eda-48e0-9963-bd67bf531afd");
appRoles1.isEnabled = true;
appRoles1.description = "msiam_access";
appRoles1.value = null;
appRoles1.origin = "Application";
appRolesList.add(appRoles1);
AppRole appRoles2 = new AppRole();
LinkedList<String> allowedMemberTypesList2 = new LinkedList<String>();
allowedMemberTypesList2.add("User");
appRoles2.allowedMemberTypes = allowedMemberTypesList2;
appRoles2.description = "Admin,WAAD";
appRoles2.displayName = "Admin,WAAD";
appRoles2.id = UUID.fromString("3a84e31e-bffa-470f-b9e6-754a61e4dc63");
appRoles2.isEnabled = true;
appRoles2.value = "arn:aws:iam::212743507312:role/accountname-aws-admin,arn:aws:iam::212743507312:saml-provider/WAAD";
appRolesList.add(appRoles2);
AppRole appRoles3 = new AppRole();
LinkedList<String> allowedMemberTypesList3 = new LinkedList<String>();
allowedMemberTypesList3.add("User");
appRoles3.allowedMemberTypes = allowedMemberTypesList3;
appRoles3.description = "Finance,WAAD";
appRoles3.displayName = "Finance,WAAD";
appRoles3.id = UUID.fromString("7a960000-ded3-455b-8c04-4f2ace00319b");
appRoles3.isEnabled = true;
appRoles3.value = "arn:aws:iam::212743507312:role/accountname-aws-finance,arn:aws:iam::212743507312:saml-provider/WAAD";
appRolesList.add(appRoles3);
servicePrincipal.appRoles = appRolesList;

graphClient.serviceprincipals("a750f6cf-2319-464a-bcc3-456926736a91")
	.buildRequest()
	.patch(servicePrincipal);


const options = {
	authProvider,
};

const client = Client.init(options);

const servicePrincipal = {
  appRoles: [
    {
      allowedMemberTypes: [
        'User'
      ],
      displayName: 'User',
      id: '8774f594-1d59-4279-b9d9-59ef09a23530',
      isEnabled: true,
      description: 'User',
      value: null,
      origin: 'Application'
    },
    {
      allowedMemberTypes: [
        'User'
      ],
      displayName: 'msiam_access',
      id: 'e7f1a7f3-9eda-48e0-9963-bd67bf531afd',
      isEnabled: true,
      description: 'msiam_access',
      value: null,
      origin: 'Application'
    },
    {
      allowedMemberTypes: [
        'User'
      ],
      description: 'Admin,WAAD',
      displayName: 'Admin,WAAD',
      id: '3a84e31e-bffa-470f-b9e6-754a61e4dc63',
      isEnabled: true,
      value: 'arn:aws:iam::212743507312:role/accountname-aws-admin,arn:aws:iam::212743507312:saml-provider/WAAD'
    },
    {
      allowedMemberTypes: [
        'User'
      ],
      description: 'Finance,WAAD',
      displayName: 'Finance,WAAD',
      id: '7a960000-ded3-455b-8c04-4f2ace00319b',
      isEnabled: true,
      value: 'arn:aws:iam::212743507312:role/accountname-aws-finance,arn:aws:iam::212743507312:saml-provider/WAAD'
    }
  ]
};

await client.api('/serviceprincipals/a750f6cf-2319-464a-bcc3-456926736a91')
	.update(servicePrincipal);

Snippet not available


Import-Module Microsoft.Graph.Applications

$params = @{
	appRoles = @(
		@{
			allowedMemberTypes = @(
				"User"
			)
			displayName = "User"
			id = "8774f594-1d59-4279-b9d9-59ef09a23530"
			isEnabled = $true
			description = "User"
			value = $null
			origin = "Application"
		}
		@{
			allowedMemberTypes = @(
				"User"
			)
			displayName = "msiam_access"
			id = "e7f1a7f3-9eda-48e0-9963-bd67bf531afd"
			isEnabled = $true
			description = "msiam_access"
			value = $null
			origin = "Application"
		}
		@{
			allowedMemberTypes = @(
				"User"
			)
			description = "Admin,WAAD"
			displayName = "Admin,WAAD"
			id = "3a84e31e-bffa-470f-b9e6-754a61e4dc63"
			isEnabled = $true
			value = "arn:aws:iam::212743507312:role/accountname-aws-admin,arn:aws:iam::212743507312:saml-provider/WAAD"
		}
		@{
			allowedMemberTypes = @(
				"User"
			)
			description = "Finance,WAAD"
			displayName = "Finance,WAAD"
			id = "7a960000-ded3-455b-8c04-4f2ace00319b"
			isEnabled = $true
			value = "arn:aws:iam::212743507312:role/accountname-aws-finance,arn:aws:iam::212743507312:saml-provider/WAAD"
		}
	)
}

Update-MgServicePrincipal -ServicePrincipalId $servicePrincipalId -BodyParameter $params

Respuesta

HTTP/1.1 204 No Content

Paso 3: Configurar la asignación de notificaciones

Crear una directiva de asignación de notificaciones

Además de las notificaciones básicas, configure las siguientes notificaciones para que Azure AD las emita en el token SAML:

Nombre de la notificación	Origen
`https://aws.amazon.com/SAML/Attributes/Role`	assignedroles
`https://aws.amazon.com/SAML/Attributes/RoleSessionName`	userprincipalname
`https://aws.amazon.com/SAML/Attributes/SessionDuration`	"900"
roles	assignedroles
`http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier`	userprincipalname

Nota:

Algunas claves de la directiva de asignación de notificaciones distinguen entre mayúsculas y minúsculas (por ejemplo, "Versión"). Si recibe un mensaje de error como "La propiedad tiene un valor no válido", puede deberse a la diferenciación entre mayúsculas y minúsculas.

Cree la directiva de asignación de notificaciones y registre el valor de la propiedad id para usarlo más adelante en este tutorial.

Solicitud

POST https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies
Content-type: application/json

{
    "definition": [
        "{\"ClaimsMappingPolicy\":{\"Version\":1,\"IncludeBasicClaimSet\":\"true\", \"ClaimsSchema\": [{\"Source\":\"user\",\"ID\":\"assignedroles\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/Role\"}, {\"Source\":\"user\",\"ID\":\"userprincipalname\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/RoleSessionName\"}, {\"Value\":\"900\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/SessionDuration\"}, {\"Source\":\"user\",\"ID\":\"assignedroles\",\"SamlClaimType\": \"appRoles\"}, {\"Source\":\"user\",\"ID\":\"userprincipalname\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/nameidentifier\"}]}}"
    ],
    "displayName": "AWS Claims Policy",
    "isOrganizationDefault": false
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new ClaimsMappingPolicy
{
	Definition = new List<string>
	{
		"{\"ClaimsMappingPolicy\":{\"Version\":1,\"IncludeBasicClaimSet\":\"true\", \"ClaimsSchema\": [{\"Source\":\"user\",\"ID\":\"assignedroles\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/Role\"}, {\"Source\":\"user\",\"ID\":\"userprincipalname\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/RoleSessionName\"}, {\"Value\":\"900\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/SessionDuration\"}, {\"Source\":\"user\",\"ID\":\"assignedroles\",\"SamlClaimType\": \"appRoles\"}, {\"Source\":\"user\",\"ID\":\"userprincipalname\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/nameidentifier\"}]}}",
	},
	DisplayName = "AWS Claims Policy",
	IsOrganizationDefault = false,
};
var result = await graphClient.Policies.ClaimsMappingPolicies.PostAsync(requestBody);



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewClaimsMappingPolicy()
definition := []string {
	"{\"ClaimsMappingPolicy\":{\"Version\":1,\"IncludeBasicClaimSet\":\"true\", \"ClaimsSchema\": [{\"Source\":\"user\",\"ID\":\"assignedroles\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/Role\"}, {\"Source\":\"user\",\"ID\":\"userprincipalname\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/RoleSessionName\"}, {\"Value\":\"900\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/SessionDuration\"}, {\"Source\":\"user\",\"ID\":\"assignedroles\",\"SamlClaimType\": \"appRoles\"}, {\"Source\":\"user\",\"ID\":\"userprincipalname\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/nameidentifier\"}]}}",

}
requestBody.SetDefinition(definition)
displayName := "AWS Claims Policy"
requestBody.SetDisplayName(&displayName) 
isOrganizationDefault := false
requestBody.SetIsOrganizationDefault(&isOrganizationDefault) 

result, err := graphClient.Policies().ClaimsMappingPolicies().Post(context.Background(), requestBody, nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

ClaimsMappingPolicy claimsMappingPolicy = new ClaimsMappingPolicy();
LinkedList<String> definitionList = new LinkedList<String>();
definitionList.add("{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"true", "ClaimsSchema": [{"Source":"user","ID":"assignedroles","SamlClaimType": "https://aws.amazon.com/SAML/Attributes/Role"}, {"Source":"user","ID":"userprincipalname","SamlClaimType": "https://aws.amazon.com/SAML/Attributes/RoleSessionName"}, {"Value":"900","SamlClaimType": "https://aws.amazon.com/SAML/Attributes/SessionDuration"}, {"Source":"user","ID":"assignedroles","SamlClaimType": "appRoles"}, {"Source":"user","ID":"userprincipalname","SamlClaimType": "https://aws.amazon.com/SAML/Attributes/nameidentifier"}]}}");
claimsMappingPolicy.definition = definitionList;
claimsMappingPolicy.displayName = "AWS Claims Policy";
claimsMappingPolicy.isOrganizationDefault = false;

graphClient.policies().claimsMappingPolicies()
	.buildRequest()
	.post(claimsMappingPolicy);


const options = {
	authProvider,
};

const client = Client.init(options);

const claimsMappingPolicy = {
    definition: [
        '{\"ClaimsMappingPolicy\':{\'Version\':1,\'IncludeBasicClaimSet\':\'true\", \"ClaimsSchema\': [{\'Source\':\'user\",\"ID\':\'assignedroles\",\"SamlClaimType\': \'https://aws.amazon.com/SAML/Attributes/Role\"}, {\"Source\':\'user\",\"ID\':\'userprincipalname\",\"SamlClaimType\': \'https://aws.amazon.com/SAML/Attributes/RoleSessionName\"}, {\"Value\':\'900\",\"SamlClaimType\': \'https://aws.amazon.com/SAML/Attributes/SessionDuration\"}, {\"Source\':\'user\",\"ID\':\'assignedroles\",\"SamlClaimType\': \'appRoles\"}, {\"Source\':\'user\",\"ID\':\'userprincipalname\",\"SamlClaimType\': \"https://aws.amazon.com/SAML/Attributes/nameidentifier\"}]}}"
    ],
    displayName: 'AWS Claims Policy',
    isOrganizationDefault: false
};

await client.api('/policies/claimsMappingPolicies')
	.post(claimsMappingPolicy);


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new ClaimsMappingPolicy();
$requestBody->setDefinition(['{\"ClaimsMappingPolicy\":{\"Version\":1,\"IncludeBasicClaimSet\":\"true\", \"ClaimsSchema\": [{\"Source\":\"user\",\"ID\":\"assignedroles\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/Role\"}, {\"Source\":\"user\",\"ID\":\"userprincipalname\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/RoleSessionName\"}, {\"Value\":\"900\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/SessionDuration\"}, {\"Source\":\"user\",\"ID\":\"assignedroles\",\"SamlClaimType\": \"appRoles\"}, {\"Source\":\"user\",\"ID\":\"userprincipalname\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/nameidentifier\"}]}}', ]);

$requestBody->setDisplayName('AWS Claims Policy');

$requestBody->setIsOrganizationDefault(false);



$result = $graphServiceClient->policies()->claimsMappingPolicies()->post($requestBody);


Import-Module Microsoft.Graph.Identity.SignIns

$params = @{
	definition = @(
		"{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"true", "ClaimsSchema": [{"Source":"user","ID":"assignedroles","SamlClaimType": "https://aws.amazon.com/SAML/Attributes/Role"}, {"Source":"user","ID":"userprincipalname","SamlClaimType": "https://aws.amazon.com/SAML/Attributes/RoleSessionName"}, {"Value":"900","SamlClaimType": "https://aws.amazon.com/SAML/Attributes/SessionDuration"}, {"Source":"user","ID":"assignedroles","SamlClaimType": "appRoles"}, {"Source":"user","ID":"userprincipalname","SamlClaimType": "https://aws.amazon.com/SAML/Attributes/nameidentifier"}]}}"
	)
	displayName = "AWS Claims Policy"
	isOrganizationDefault = $false
}

New-MgPolicyClaimMappingPolicy -BodyParameter $params

Respuesta

HTTP/1.1 201 Created
Content-type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#policies/claimsMappingPolicies/$entity",
    "id": "4bce7ba7-466d-4239-94b8-cf4f21428ca7",
    "deletedDateTime": null,
    "definition": [
        "{\"ClaimsMappingPolicy\":{\"Version\":1,\"IncludeBasicClaimSet\":\"true\", \"ClaimsSchema\": [{\"Source\":\"user\",\"ID\":\"assignedroles\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/Role\"}, {\"Source\":\"user\",\"ID\":\"userprincipalname\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/RoleSessionName\"}, {\"Value\":\"900\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/SessionDuration\"}, {\"Source\":\"user\",\"ID\":\"assignedroles\",\"SamlClaimType\": \"appRoles\"}, {\"Source\":\"user\",\"ID\":\"userprincipalname\",\"SamlClaimType\": \"https://aws.amazon.com/SAML/Attributes/nameidentifier\"}]}}"
    ],
    "displayName": "AWS Claims Policy",
    "isOrganizationDefault": false
}

Asignar la directiva de asignación de notificaciones a la entidad de servicio

Use el Id para la entidad de servicio que registró anteriormente para asignar una directiva de asignación de notificaciones. Use el valor de la propiedad id. de la directiva de asignación de notificaciones en el cuerpo de la solicitud.

Solicitud

POST https://graph.microsoft.com/v1.0/servicePrincipals/a750f6cf-2319-464a-bcc3-456926736a91/claimsMappingPolicies/$ref
Content-type: application/json

{
  "@odata.id":"https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/a4b35718-fd5e-4ca8-8248-a3c9934b1b78"
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new Microsoft.Graph.Models.ReferenceCreate
{
	OdataId = "https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/a4b35718-fd5e-4ca8-8248-a3c9934b1b78",
};
await graphClient.ServicePrincipals["{servicePrincipal-id}"].ClaimsMappingPolicies.Ref.PostAsync(requestBody);



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewReferenceCreate()
odataId := "https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/a4b35718-fd5e-4ca8-8248-a3c9934b1b78"
requestBody.SetOdataId(&odataId) 

graphClient.ServicePrincipals().ByServicePrincipalId("servicePrincipal-id").ClaimsMappingPolicies().Ref().Post(context.Background(), requestBody, nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

ClaimsMappingPolicy claimsMappingPolicy = new ClaimsMappingPolicy();
claimsMappingPolicy.additionalDataManager().put("@odata.id", new JsonPrimitive("https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/a4b35718-fd5e-4ca8-8248-a3c9934b1b78"));

graphClient.servicePrincipals("a750f6cf-2319-464a-bcc3-456926736a91").claimsMappingPolicies().references()
	.buildRequest()
	.post(claimsMappingPolicy);


const options = {
	authProvider,
};

const client = Client.init(options);

const claimsMappingPolicy = {
  '@odata.id':'https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/a4b35718-fd5e-4ca8-8248-a3c9934b1b78'
};

await client.api('/servicePrincipals/a750f6cf-2319-464a-bcc3-456926736a91/claimsMappingPolicies/$ref')
	.post(claimsMappingPolicy);


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new ReferenceCreate();
$requestBody->set@odataid('https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/a4b35718-fd5e-4ca8-8248-a3c9934b1b78');



$graphServiceClient->servicePrincipals()->byServicePrincipalId('servicePrincipal-id')->claimsMappingPolicies()->ref()->post($requestBody);


Import-Module Microsoft.Graph.Applications

$params = @{
	"@odata.id" = "https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/a4b35718-fd5e-4ca8-8248-a3c9934b1b78"
}

New-MgServicePrincipalClaimMappingPolicyByRef -ServicePrincipalId $servicePrincipalId -BodyParameter $params

Respuesta

HTTP/1.1 204 No Content

Paso 4: Configurar un certificado de firma

Necesitará un certificado autofirmado que Azure AD pueda usar para firmar una respuesta SAML. Puede usar su propio certificado o puede usar el siguiente ejemplo.

Opción 1: Creación de un certificado de firma en Azure AD

Con el Id de la entidad de servicio que ha creado, cree un nuevo certificado y agrégrelo a la entidad de servicio.

Solicitud

POST https://graph.microsoft.com/v1.0/servicePrincipals/a750f6cf-2319-464a-bcc3-456926736a91/addTokenSigningCertificate
Content-type: application/json

{
    "displayName":"CN=AWSContoso",
    "endDateTime":"2024-01-25T00:00:00Z"
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new Microsoft.Graph.ServicePrincipals.Item.AddTokenSigningCertificate.AddTokenSigningCertificatePostRequestBody
{
	DisplayName = "CN=AWSContoso",
	EndDateTime = DateTimeOffset.Parse("2024-01-25T00:00:00Z"),
};
var result = await graphClient.ServicePrincipals["{servicePrincipal-id}"].AddTokenSigningCertificate.PostAsync(requestBody);



import (
	  "context"
	  "time"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/ServicePrincipals/Item/AddTokenSigningCertificate"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewAddTokenSigningCertificatePostRequestBody()
displayName := "CN=AWSContoso"
requestBody.SetDisplayName(&displayName) 
endDateTime , err := time.Parse(time.RFC3339, "2024-01-25T00:00:00Z")
requestBody.SetEndDateTime(&endDateTime) 

result, err := graphClient.ServicePrincipals().ByServicePrincipalId("servicePrincipal-id").AddTokenSigningCertificate().Post(context.Background(), requestBody, nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

String displayName = "CN=AWSContoso";

OffsetDateTime endDateTime = OffsetDateTimeSerializer.deserialize("01/25/2024 00:00:00");

graphClient.servicePrincipals("a750f6cf-2319-464a-bcc3-456926736a91")
	.addTokenSigningCertificate(ServicePrincipalAddTokenSigningCertificateParameterSet
		.newBuilder()
		.withDisplayName(displayName)
		.withEndDateTime(endDateTime)
		.build())
	.buildRequest()
	.post();


const options = {
	authProvider,
};

const client = Client.init(options);

const selfSignedCertificate = {
    displayName: 'CN=AWSContoso',
    endDateTime: '2024-01-25T00:00:00Z'
};

await client.api('/servicePrincipals/a750f6cf-2319-464a-bcc3-456926736a91/addTokenSigningCertificate')
	.post(selfSignedCertificate);


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new AddTokenSigningCertificatePostRequestBody();
$requestBody->setDisplayName('CN=AWSContoso');

$requestBody->setEndDateTime(new DateTime('2024-01-25T00:00:00Z'));



$result = $graphServiceClient->servicePrincipals()->byServicePrincipalId('servicePrincipal-id')->addTokenSigningCertificate()->post($requestBody);


Import-Module Microsoft.Graph.Applications

$params = @{
	displayName = "CN=AWSContoso"
	endDateTime = [System.DateTime]::Parse("2024-01-25T00:00:00Z")
}

Add-MgServicePrincipalTokenSigningCertificate -ServicePrincipalId $servicePrincipalId -BodyParameter $params

Respuesta

HTTP/1.1 200 OK
Content-type: application/json

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.selfSignedCertificate",
  "customKeyIdentifier": "p9PEYmuKhP2oaMzGfSdNQC/9ChA=",
  "displayName": "CN=AWSContoso",
  "endDateTime": "2024-01-25T00:00:00Z",
  "key": "MIICqjCCAZKgAwIBAgIId....4rnrk43wp75yqjRbOhAZ1ExAxVqW+o2JslhjUeltUMNQW+ynOfs9oHu1ZdnGmxrE=",
  "keyId": "70883316-50be-4016-ba80-19d9fbad873d",
  "startDateTime": "2021-05-10T20:35:37.5754318Z",
  "thumbprint": "A7D3C4626B8A84FDA868CCC67D274D402FFD0A10",
  "type": "AsymmetricX509Cert",
  "usage": "Verify"
}

Opción 2: Crear un certificado de firma personalizado

Puede usar los siguientes scripts de PowerShell y C# para obtener un certificado autofirmado para las pruebas. Después, tendrá que manipular y extraer manualmente los valores que necesita mediante otras herramientas. Emplee el procedimiento de seguridad recomendado de su empresa para crear un certificado de firma para producción.

Script de PowerShell
Script de C#

Param(
    [Parameter(Mandatory=$true)]
    [string]$fqdn,
    [Parameter(Mandatory=$true)]
    [string]$pwd,
    [Parameter(Mandatory=$true)]
    [string]$location
) 

if (!$PSBoundParameters.ContainsKey('location'))
{
    $location = "."
} 

$cert = New-SelfSignedCertificate -certstorelocation cert:\currentuser\my -DnsName $fqdn
$pwdSecure = ConvertTo-SecureString -String $pwd -Force -AsPlainText
$path = 'cert:\currentuser\my\' + $cert.Thumbprint
$cerFile = $location + "\\" + $fqdn + ".cer"
$pfxFile = $location + "\\" + $fqdn + ".pfx" 

Export-PfxCertificate -cert $path -FilePath $pfxFile -Password $pwdSecure
Export-Certificate -cert $path -FilePath $cerFile

La siguiente aplicación de consola de C# se puede usar como prueba de concepto para comprender cómo se pueden obtener los valores necesarios. Este código es solo para aprendizaje y referencia y no debe usarse tal cual en producción.

using System;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Text;


/* CONSOLE APP - PROOF OF CONCEPT CODE ONLY!!
 * This code uses a self signed certificate and should not be used 
 * in production. This code is for reference and learning ONLY.
 */
namespace Self_signed_cert
{
    class Program
    {
        static void Main(string[] args)
        {
            // Generate a guid to use as a password and then create the cert.
            string password = Guid.NewGuid().ToString();
            var selfsignedCert = buildSelfSignedServerCertificate(password);

            // Print values so we can copy paste into the JSON fields.
            // Print out the private key in base64 format.
            Console.WriteLine("Private Key: {0}{1}", Convert.ToBase64String(selfsignedCert.Export(X509ContentType.Pfx, password)), Environment.NewLine);

            // Print out the start date in ISO 8601 format.
            DateTime startDate = DateTime.Parse(selfsignedCert.GetEffectiveDateString()).ToUniversalTime();
            Console.WriteLine("For All startDateTime: " + startDate.ToString("o"));

            // Print out the end date in ISO 8601 format.
            DateTime endDate = DateTime.Parse(selfsignedCert.GetExpirationDateString()).ToUniversalTime();
            Console.WriteLine("For All endDateTime: " + endDate.ToString("o"));

            // Print the GUID used for keyId
            string signAndPasswordGuid = Guid.NewGuid().ToString();
            string verifyGuid = Guid.NewGuid().ToString();
            Console.WriteLine("GUID to use for keyId for keyCredentials->Usage == Sign and passwordCredentials: " + signAndPasswordGuid);
            Console.WriteLine("GUID to use for keyId for keyCredentials->Usage == Verify: " + verifyGuid);

            // Print out the password.
            Console.WriteLine("Password is: {0}", password);

            // Print out a displayName to use as an example.
            Console.WriteLine("displayName to use: CN=Example");
            Console.WriteLine();

            // Print out the public key.
            Console.WriteLine("Public Key: {0}{1}", Convert.ToBase64String(selfsignedCert.Export(X509ContentType.Cert)), Environment.NewLine);
            Console.WriteLine();

            // Generate the customKeyIdentifier using hash of thumbprint.
            Console.WriteLine("You can generate the customKeyIdentifier by getting the SHA256 hash of the certs thumprint.\nThe certs thumbprint is: {0}{1}", selfsignedCert.Thumbprint, Environment.NewLine);
            Console.WriteLine("The hash of the thumbprint that we will use for customeKeyIdentifier is:");
            string keyIdentifier = GetSha256FromThumbprint(selfsignedCert.Thumbprint);
            Console.WriteLine(keyIdentifier);
        }

        // Generate a self-signed certificate.
        private static X509Certificate2 buildSelfSignedServerCertificate(string password)
        {
            const string CertificateName = @"Microsoft Azure Federated SSO Certificate TEST";
            DateTime certificateStartDate = DateTime.UtcNow;
            DateTime certificateEndDate = certificateStartDate.AddYears(2).ToUniversalTime();

            X500DistinguishedName distinguishedName = new X500DistinguishedName($"CN={CertificateName}");

            using (RSA rsa = RSA.Create(2048))
            {
                var request = new CertificateRequest(distinguishedName, rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);

                request.CertificateExtensions.Add(
                    new X509KeyUsageExtension(X509KeyUsageFlags.DataEncipherment | X509KeyUsageFlags.KeyEncipherment | X509KeyUsageFlags.DigitalSignature, false));

                var certificate = request.CreateSelfSigned(new DateTimeOffset(certificateStartDate), new DateTimeOffset(certificateEndDate));
                certificate.FriendlyName = CertificateName;

                return new X509Certificate2(certificate.Export(X509ContentType.Pfx, password), password, X509KeyStorageFlags.Exportable);
            }
        }

        // Generate hash from thumbprint.
        public static string GetSha256FromThumbprint(string thumbprint)
        {
            var message = Encoding.ASCII.GetBytes(thumbprint);
            SHA256Managed hashString = new SHA256Managed();
            return Convert.ToBase64String(hashString.ComputeHash(message));
        }
    }
}

Agregar una clave de firma personalizada

Después de ejecutar el código anterior, extraiga los valores de los parámetros siguientes del archivo PFX. Agregará esta información a la entidad de servicio:

Clave privada
Contraseña
Clave pública

Para obtener más información sobre las propiedades, vea keyCredential resource type.

Asegúrese de que el keyId del keyCredential usado para "Sign" coincide con el keyId de passwordCredential. Puede generar customkeyIdentifier mediante la obtención del hash de la huella digital del certificado. Vea el código C# de referencia anterior.

Solicitud

Nota:

Se ha abreviado el valor "clave" en la propiedad keyCredentials para facilitar la lectura. El valor está codificado en base 64. Para la clave privada, la propiedad usage es "Sign". Para la clave pública, la propiedad usage es "Verify".

PATCH https://graph.microsoft.com/v1.0/servicePrincipals/f47a6776-bca7-4f2e-bc6c-eec59d058e3e
Content-type: application/json

{
    "keyCredentials":[
        {
            "customKeyIdentifier": "lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=",
            "endDateTime": "2021-04-22T22:10:13Z",
            "keyId": "4c266507-3e74-4b91-aeba-18a25b450f6e",
            "startDateTime": "2020-04-22T21:50:13Z",
            "type": "X509CertAndPassword",
            "usage": "Sign",
            "key":"MIIKIAIBAz.....HBgUrDgMCERE20nuTptI9MEFCh2Ih2jaaLZBZGeZBRFVNXeZmAAgIH0A==",
            "displayName": "CN=awsAPI"
        },
        {
            "customKeyIdentifier": "lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=",
            "endDateTime": "2021-04-22T22:10:13Z",
            "keyId": "e35a7d11-fef0-49ad-9f3e-aacbe0a42c42",
            "startDateTime": "2020-04-22T21:50:13Z",
            "type": "AsymmetricX509Cert",
            "usage": "Verify",
            "key": "MIIDJzCCAg+gAw......CTxQvJ/zN3bafeesMSueR83hlCSyg==",
            "displayName": "CN=awsAPI"
        }

    ],
    "passwordCredentials": [
        {
            "customKeyIdentifier": "lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=",
            "keyId": "4c266507-3e74-4b91-aeba-18a25b450f6e",
            "endDateTime": "2022-01-27T19:40:33Z",
            "startDateTime": "2020-04-20T19:40:33Z",
            "secretText": "61891f4ee44d"
        }
    ]
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new ServicePrincipal
{
	KeyCredentials = new List<KeyCredential>
	{
		new KeyCredential
		{
			CustomKeyIdentifier = Convert.FromBase64String("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA="),
			EndDateTime = DateTimeOffset.Parse("2021-04-22T22:10:13Z"),
			KeyId = Guid.Parse("4c266507-3e74-4b91-aeba-18a25b450f6e"),
			StartDateTime = DateTimeOffset.Parse("2020-04-22T21:50:13Z"),
			Type = "X509CertAndPassword",
			Usage = "Sign",
			Key = Convert.FromBase64String("MIIKIAIBAz.....HBgUrDgMCERE20nuTptI9MEFCh2Ih2jaaLZBZGeZBRFVNXeZmAAgIH0A=="),
			DisplayName = "CN=awsAPI",
		},
		new KeyCredential
		{
			CustomKeyIdentifier = Convert.FromBase64String("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA="),
			EndDateTime = DateTimeOffset.Parse("2021-04-22T22:10:13Z"),
			KeyId = Guid.Parse("e35a7d11-fef0-49ad-9f3e-aacbe0a42c42"),
			StartDateTime = DateTimeOffset.Parse("2020-04-22T21:50:13Z"),
			Type = "AsymmetricX509Cert",
			Usage = "Verify",
			Key = Convert.FromBase64String("MIIDJzCCAg+gAw......CTxQvJ/zN3bafeesMSueR83hlCSyg=="),
			DisplayName = "CN=awsAPI",
		},
	},
	PasswordCredentials = new List<PasswordCredential>
	{
		new PasswordCredential
		{
			CustomKeyIdentifier = Convert.FromBase64String("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA="),
			KeyId = Guid.Parse("4c266507-3e74-4b91-aeba-18a25b450f6e"),
			EndDateTime = DateTimeOffset.Parse("2022-01-27T19:40:33Z"),
			StartDateTime = DateTimeOffset.Parse("2020-04-20T19:40:33Z"),
			SecretText = "61891f4ee44d",
		},
	},
};
var result = await graphClient.ServicePrincipals["{servicePrincipal-id}"].PatchAsync(requestBody);



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewServicePrincipal()


keyCredential := graphmodels.NewKeyCredential()
customKeyIdentifier := []byte("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=")
keyCredential.SetCustomKeyIdentifier(&customKeyIdentifier) 
endDateTime , err := time.Parse(time.RFC3339, "2021-04-22T22:10:13Z")
keyCredential.SetEndDateTime(&endDateTime) 
keyId := uuid.MustParse("4c266507-3e74-4b91-aeba-18a25b450f6e")
keyCredential.SetKeyId(&keyId) 
startDateTime , err := time.Parse(time.RFC3339, "2020-04-22T21:50:13Z")
keyCredential.SetStartDateTime(&startDateTime) 
type := "X509CertAndPassword"
keyCredential.SetType(&type) 
usage := "Sign"
keyCredential.SetUsage(&usage) 
key := []byte("mIIKIAIBAz.....HBgUrDgMCERE20nuTptI9MEFCh2Ih2jaaLZBZGeZBRFVNXeZmAAgIH0A==")
keyCredential.SetKey(&key) 
displayName := "CN=awsAPI"
keyCredential.SetDisplayName(&displayName) 
keyCredential1 := graphmodels.NewKeyCredential()
customKeyIdentifier := []byte("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=")
keyCredential1.SetCustomKeyIdentifier(&customKeyIdentifier) 
endDateTime , err := time.Parse(time.RFC3339, "2021-04-22T22:10:13Z")
keyCredential1.SetEndDateTime(&endDateTime) 
keyId := uuid.MustParse("e35a7d11-fef0-49ad-9f3e-aacbe0a42c42")
keyCredential1.SetKeyId(&keyId) 
startDateTime , err := time.Parse(time.RFC3339, "2020-04-22T21:50:13Z")
keyCredential1.SetStartDateTime(&startDateTime) 
type := "AsymmetricX509Cert"
keyCredential1.SetType(&type) 
usage := "Verify"
keyCredential1.SetUsage(&usage) 
key := []byte("mIIDJzCCAg+gAw......CTxQvJ/zN3bafeesMSueR83hlCSyg==")
keyCredential1.SetKey(&key) 
displayName := "CN=awsAPI"
keyCredential1.SetDisplayName(&displayName) 

keyCredentials := []graphmodels.KeyCredentialable {
	keyCredential,
	keyCredential1,

}
requestBody.SetKeyCredentials(keyCredentials)


passwordCredential := graphmodels.NewPasswordCredential()
customKeyIdentifier := []byte("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=")
passwordCredential.SetCustomKeyIdentifier(&customKeyIdentifier) 
keyId := uuid.MustParse("4c266507-3e74-4b91-aeba-18a25b450f6e")
passwordCredential.SetKeyId(&keyId) 
endDateTime , err := time.Parse(time.RFC3339, "2022-01-27T19:40:33Z")
passwordCredential.SetEndDateTime(&endDateTime) 
startDateTime , err := time.Parse(time.RFC3339, "2020-04-20T19:40:33Z")
passwordCredential.SetStartDateTime(&startDateTime) 
secretText := "61891f4ee44d"
passwordCredential.SetSecretText(&secretText) 

passwordCredentials := []graphmodels.PasswordCredentialable {
	passwordCredential,

}
requestBody.SetPasswordCredentials(passwordCredentials)

result, err := graphClient.ServicePrincipals().ByServicePrincipalId("servicePrincipal-id").Patch(context.Background(), requestBody, nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

ServicePrincipal servicePrincipal = new ServicePrincipal();
LinkedList<KeyCredential> keyCredentialsList = new LinkedList<KeyCredential>();
KeyCredential keyCredentials = new KeyCredential();
keyCredentials.customKeyIdentifier = Base64.getDecoder().decode("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=");
keyCredentials.endDateTime = OffsetDateTimeSerializer.deserialize("2021-04-22T22:10:13Z");
keyCredentials.keyId = UUID.fromString("4c266507-3e74-4b91-aeba-18a25b450f6e");
keyCredentials.startDateTime = OffsetDateTimeSerializer.deserialize("2020-04-22T21:50:13Z");
keyCredentials.type = "X509CertAndPassword";
keyCredentials.usage = "Sign";
keyCredentials.key = Base64.getDecoder().decode("MIIKIAIBAz.....HBgUrDgMCERE20nuTptI9MEFCh2Ih2jaaLZBZGeZBRFVNXeZmAAgIH0A==");
keyCredentials.displayName = "CN=awsAPI";
keyCredentialsList.add(keyCredentials);
KeyCredential keyCredentials1 = new KeyCredential();
keyCredentials1.customKeyIdentifier = Base64.getDecoder().decode("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=");
keyCredentials1.endDateTime = OffsetDateTimeSerializer.deserialize("2021-04-22T22:10:13Z");
keyCredentials1.keyId = UUID.fromString("e35a7d11-fef0-49ad-9f3e-aacbe0a42c42");
keyCredentials1.startDateTime = OffsetDateTimeSerializer.deserialize("2020-04-22T21:50:13Z");
keyCredentials1.type = "AsymmetricX509Cert";
keyCredentials1.usage = "Verify";
keyCredentials1.key = Base64.getDecoder().decode("MIIDJzCCAg+gAw......CTxQvJ/zN3bafeesMSueR83hlCSyg==");
keyCredentials1.displayName = "CN=awsAPI";
keyCredentialsList.add(keyCredentials1);
servicePrincipal.keyCredentials = keyCredentialsList;
LinkedList<PasswordCredential> passwordCredentialsList = new LinkedList<PasswordCredential>();
PasswordCredential passwordCredentials = new PasswordCredential();
passwordCredentials.customKeyIdentifier = Base64.getDecoder().decode("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=");
passwordCredentials.keyId = UUID.fromString("4c266507-3e74-4b91-aeba-18a25b450f6e");
passwordCredentials.endDateTime = OffsetDateTimeSerializer.deserialize("2022-01-27T19:40:33Z");
passwordCredentials.startDateTime = OffsetDateTimeSerializer.deserialize("2020-04-20T19:40:33Z");
passwordCredentials.secretText = "61891f4ee44d";
passwordCredentialsList.add(passwordCredentials);
servicePrincipal.passwordCredentials = passwordCredentialsList;

graphClient.servicePrincipals("f47a6776-bca7-4f2e-bc6c-eec59d058e3e")
	.buildRequest()
	.patch(servicePrincipal);


const options = {
	authProvider,
};

const client = Client.init(options);

const servicePrincipal = {
    keyCredentials: [
        {
            customKeyIdentifier: 'lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=',
            endDateTime: '2021-04-22T22:10:13Z',
            keyId: '4c266507-3e74-4b91-aeba-18a25b450f6e',
            startDateTime: '2020-04-22T21:50:13Z',
            type: 'X509CertAndPassword',
            usage: 'Sign',
            key: 'MIIKIAIBAz.....HBgUrDgMCERE20nuTptI9MEFCh2Ih2jaaLZBZGeZBRFVNXeZmAAgIH0A==',
            displayName: 'CN=awsAPI'
        },
        {
            customKeyIdentifier: 'lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=',
            endDateTime: '2021-04-22T22:10:13Z',
            keyId: 'e35a7d11-fef0-49ad-9f3e-aacbe0a42c42',
            startDateTime: '2020-04-22T21:50:13Z',
            type: 'AsymmetricX509Cert',
            usage: 'Verify',
            key: 'MIIDJzCCAg+gAw......CTxQvJ/zN3bafeesMSueR83hlCSyg==',
            displayName: 'CN=awsAPI'
        }

    ],
    passwordCredentials: [
        {
            customKeyIdentifier: 'lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=',
            keyId: '4c266507-3e74-4b91-aeba-18a25b450f6e',
            endDateTime: '2022-01-27T19:40:33Z',
            startDateTime: '2020-04-20T19:40:33Z',
            secretText: '61891f4ee44d'
        }
    ]
};

await client.api('/servicePrincipals/f47a6776-bca7-4f2e-bc6c-eec59d058e3e')
	.update(servicePrincipal);

Snippet not available


Import-Module Microsoft.Graph.Applications

$params = @{
	keyCredentials = @(
		@{
			customKeyIdentifier = [System.Text.Encoding]::ASCII.GetBytes("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=")
			endDateTime = [System.DateTime]::Parse("2021-04-22T22:10:13Z")
			keyId = "4c266507-3e74-4b91-aeba-18a25b450f6e"
			startDateTime = [System.DateTime]::Parse("2020-04-22T21:50:13Z")
			type = "X509CertAndPassword"
			usage = "Sign"
			key = [System.Text.Encoding]::ASCII.GetBytes("MIIKIAIBAz.....HBgUrDgMCERE20nuTptI9MEFCh2Ih2jaaLZBZGeZBRFVNXeZmAAgIH0A==")
			displayName = "CN=awsAPI"
		}
		@{
			customKeyIdentifier = [System.Text.Encoding]::ASCII.GetBytes("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=")
			endDateTime = [System.DateTime]::Parse("2021-04-22T22:10:13Z")
			keyId = "e35a7d11-fef0-49ad-9f3e-aacbe0a42c42"
			startDateTime = [System.DateTime]::Parse("2020-04-22T21:50:13Z")
			type = "AsymmetricX509Cert"
			usage = "Verify"
			key = [System.Text.Encoding]::ASCII.GetBytes("MIIDJzCCAg+gAw......CTxQvJ/zN3bafeesMSueR83hlCSyg==")
			displayName = "CN=awsAPI"
		}
	)
	passwordCredentials = @(
		@{
			customKeyIdentifier = [System.Text.Encoding]::ASCII.GetBytes("lY85bR8r6yWTW6jnciNEONwlVhDyiQjdVLgPDnkI5mA=")
			keyId = "4c266507-3e74-4b91-aeba-18a25b450f6e"
			endDateTime = [System.DateTime]::Parse("2022-01-27T19:40:33Z")
			startDateTime = [System.DateTime]::Parse("2020-04-20T19:40:33Z")
			secretText = "61891f4ee44d"
		}
	)
}

Update-MgServicePrincipal -ServicePrincipalId $servicePrincipalId -BodyParameter $params

Respuesta

HTTP/1.1 204 No Content

Activar la clave de firma personalizada

Debe establecer la propiedad PreferredTokenSigningKeyThumbprint de la entidad de servicio con la huella digital del certificado que quiere que use Azure AD para firmar la respuesta SAML.

Solicitud

PATCH https://graph.microsoft.com/v1.0/servicePrincipals/a750f6cf-2319-464a-bcc3-456926736a91
Content-type: application/json

{
  "preferredTokenSigningKeyThumbprint": "A7D3C4626B8A84FDA868CCC67D274D402FFD0A10"
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new ServicePrincipal
{
	PreferredTokenSigningKeyThumbprint = "A7D3C4626B8A84FDA868CCC67D274D402FFD0A10",
};
var result = await graphClient.ServicePrincipals["{servicePrincipal-id}"].PatchAsync(requestBody);



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewServicePrincipal()
preferredTokenSigningKeyThumbprint := "A7D3C4626B8A84FDA868CCC67D274D402FFD0A10"
requestBody.SetPreferredTokenSigningKeyThumbprint(&preferredTokenSigningKeyThumbprint) 

result, err := graphClient.ServicePrincipals().ByServicePrincipalId("servicePrincipal-id").Patch(context.Background(), requestBody, nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

ServicePrincipal servicePrincipal = new ServicePrincipal();
servicePrincipal.preferredTokenSigningKeyThumbprint = "A7D3C4626B8A84FDA868CCC67D274D402FFD0A10";

graphClient.servicePrincipals("a750f6cf-2319-464a-bcc3-456926736a91")
	.buildRequest()
	.patch(servicePrincipal);


const options = {
	authProvider,
};

const client = Client.init(options);

const servicePrincipal = {
  preferredTokenSigningKeyThumbprint: 'A7D3C4626B8A84FDA868CCC67D274D402FFD0A10'
};

await client.api('/servicePrincipals/a750f6cf-2319-464a-bcc3-456926736a91')
	.update(servicePrincipal);


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new ServicePrincipal();
$requestBody->setPreferredTokenSigningKeyThumbprint('A7D3C4626B8A84FDA868CCC67D274D402FFD0A10');



$result = $graphServiceClient->servicePrincipals()->byServicePrincipalId('servicePrincipal-id')->patch($requestBody);


Import-Module Microsoft.Graph.Applications

$params = @{
	preferredTokenSigningKeyThumbprint = "A7D3C4626B8A84FDA868CCC67D274D402FFD0A10"
}

Update-MgServicePrincipal -ServicePrincipalId $servicePrincipalId -BodyParameter $params

Respuesta

HTTP/1.1 204 No Content

Paso 5: Asignar usuarios

Crear una cuenta de usuario

Para este tutorial, debe crear una cuenta de usuario que se agrega a la aplicación. En el cuerpo de la solicitud, cambie contoso.com por el nombre de dominio de su espacio empresarial. Puede encontrar la información del espacio empresarial en la página de información general de Azure Active Directory. Registre el id. del usuario que se usará más adelante en el tutorial.

Solicitud

POST https://graph.microsoft.com/v1.0/users
Content-type: application/json

{
  "accountEnabled":true,
  "displayName":"MyTestUser1",
  "mailNickname":"MyTestUser1",
  "userPrincipalName":"MyTestUser1@contoso.com",
  "passwordProfile": {
    "forceChangePasswordNextSignIn":true,
    "password":"Contoso1234"
  }
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new User
{
	AccountEnabled = true,
	DisplayName = "MyTestUser1",
	MailNickname = "MyTestUser1",
	UserPrincipalName = "MyTestUser1@contoso.com",
	PasswordProfile = new PasswordProfile
	{
		ForceChangePasswordNextSignIn = true,
		Password = "Contoso1234",
	},
};
var result = await graphClient.Users.PostAsync(requestBody);



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewUser()
accountEnabled := true
requestBody.SetAccountEnabled(&accountEnabled) 
displayName := "MyTestUser1"
requestBody.SetDisplayName(&displayName) 
mailNickname := "MyTestUser1"
requestBody.SetMailNickname(&mailNickname) 
userPrincipalName := "MyTestUser1@contoso.com"
requestBody.SetUserPrincipalName(&userPrincipalName) 
passwordProfile := graphmodels.NewPasswordProfile()
forceChangePasswordNextSignIn := true
passwordProfile.SetForceChangePasswordNextSignIn(&forceChangePasswordNextSignIn) 
password := "Contoso1234"
passwordProfile.SetPassword(&password) 
requestBody.SetPasswordProfile(passwordProfile)

result, err := graphClient.Users().Post(context.Background(), requestBody, nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

User user = new User();
user.accountEnabled = true;
user.displayName = "MyTestUser1";
user.mailNickname = "MyTestUser1";
user.userPrincipalName = "MyTestUser1@contoso.com";
PasswordProfile passwordProfile = new PasswordProfile();
passwordProfile.forceChangePasswordNextSignIn = true;
passwordProfile.password = "Contoso1234";
user.passwordProfile = passwordProfile;

graphClient.users()
	.buildRequest()
	.post(user);


const options = {
	authProvider,
};

const client = Client.init(options);

const user = {
  accountEnabled: true,
  displayName: 'MyTestUser1',
  mailNickname: 'MyTestUser1',
  userPrincipalName: 'MyTestUser1@contoso.com',
  passwordProfile: {
    forceChangePasswordNextSignIn: true,
    password: 'Contoso1234'
  }
};

await client.api('/users')
	.post(user);


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new User();
$requestBody->setAccountEnabled(true);

$requestBody->setDisplayName('MyTestUser1');

$requestBody->setMailNickname('MyTestUser1');

$requestBody->setUserPrincipalName('MyTestUser1@contoso.com');

$passwordProfile = new PasswordProfile();
$passwordProfile->setForceChangePasswordNextSignIn(true);

$passwordProfile->setPassword('Contoso1234');


$requestBody->setPasswordProfile($passwordProfile);


$result = $graphServiceClient->users()->post($requestBody);


Import-Module Microsoft.Graph.Users

$params = @{
	accountEnabled = $true
	displayName = "MyTestUser1"
	mailNickname = "MyTestUser1"
	userPrincipalName = "MyTestUser1@contoso.com"
	passwordProfile = @{
		forceChangePasswordNextSignIn = $true
		password = "Contoso1234"
	}
}

New-MgUser -BodyParameter $params

Respuesta

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
  "id": "040f9599-7c0f-4f94-aa75-8394c4c6ea9b",
  "businessPhones": [],
  "displayName": "MyTestUser1",
  "userPrincipalName": "MyTestUser1@contoso.com"
}

Asignar un usuario a la aplicación

Asigne el usuario que creó a la entidad de servicio y asigne el rol de la aplicación Admin,WAAD.

En el cuerpo de la solicitud, proporcione estos valores:

principalId: el id. de la cuenta de usuario que creó.
appRoleId: el id. del rol de aplicación Admin,WAAD que agregó.
resourceId: el id. del principal de servicio.

Solicitud

POST https://graph.microsoft.com/v1.0/servicePrincipals/a750f6cf-2319-464a-bcc3-456926736a91/appRoleAssignments
Content-type: application/json

{
  "principalId": "040f9599-7c0f-4f94-aa75-8394c4c6ea9b",
  "principalType": "User",
  "appRoleId":"3a84e31e-bffa-470f-b9e6-754a61e4dc63",
  "resourceId":"a750f6cf-2319-464a-bcc3-456926736a91"
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new AppRoleAssignment
{
	PrincipalId = Guid.Parse("040f9599-7c0f-4f94-aa75-8394c4c6ea9b"),
	PrincipalType = "User",
	AppRoleId = Guid.Parse("3a84e31e-bffa-470f-b9e6-754a61e4dc63"),
	ResourceId = Guid.Parse("a750f6cf-2319-464a-bcc3-456926736a91"),
};
var result = await graphClient.ServicePrincipals["{servicePrincipal-id}"].AppRoleAssignments.PostAsync(requestBody);



import (
	  "context"
	  "github.com/google/uuid"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewAppRoleAssignment()
principalId := uuid.MustParse("040f9599-7c0f-4f94-aa75-8394c4c6ea9b")
requestBody.SetPrincipalId(&principalId) 
principalType := "User"
requestBody.SetPrincipalType(&principalType) 
appRoleId := uuid.MustParse("3a84e31e-bffa-470f-b9e6-754a61e4dc63")
requestBody.SetAppRoleId(&appRoleId) 
resourceId := uuid.MustParse("a750f6cf-2319-464a-bcc3-456926736a91")
requestBody.SetResourceId(&resourceId) 

result, err := graphClient.ServicePrincipals().ByServicePrincipalId("servicePrincipal-id").AppRoleAssignments().Post(context.Background(), requestBody, nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AppRoleAssignment appRoleAssignment = new AppRoleAssignment();
appRoleAssignment.principalId = UUID.fromString("040f9599-7c0f-4f94-aa75-8394c4c6ea9b");
appRoleAssignment.principalType = "User";
appRoleAssignment.appRoleId = UUID.fromString("3a84e31e-bffa-470f-b9e6-754a61e4dc63");
appRoleAssignment.resourceId = UUID.fromString("a750f6cf-2319-464a-bcc3-456926736a91");

graphClient.servicePrincipals("a750f6cf-2319-464a-bcc3-456926736a91").appRoleAssignments()
	.buildRequest()
	.post(appRoleAssignment);


const options = {
	authProvider,
};

const client = Client.init(options);

const appRoleAssignment = {
  principalId: '040f9599-7c0f-4f94-aa75-8394c4c6ea9b',
  principalType: 'User',
  appRoleId: '3a84e31e-bffa-470f-b9e6-754a61e4dc63',
  resourceId: 'a750f6cf-2319-464a-bcc3-456926736a91'
};

await client.api('/servicePrincipals/a750f6cf-2319-464a-bcc3-456926736a91/appRoleAssignments')
	.post(appRoleAssignment);

Snippet not available


Import-Module Microsoft.Graph.Applications

$params = @{
	principalId = "040f9599-7c0f-4f94-aa75-8394c4c6ea9b"
	principalType = "User"
	appRoleId = "3a84e31e-bffa-470f-b9e6-754a61e4dc63"
	resourceId = "a750f6cf-2319-464a-bcc3-456926736a91"
}

New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $servicePrincipalId -BodyParameter $params

Respuesta

HTTP/1.1 201 
Content-type: application/json

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('a750f6cf-2319-464a-bcc3-456926736a91')/appRoleAssignments/$entity",
  "id": "mZUPBA98lE-qdYOUxMbqm2qY3odGRGdFtpYJkAfUC0Q",
  "deletedDateTime": null,
  "appRoleId": "3a84e31e-bffa-470f-b9e6-754a61e4dc63",
  "createdDateTime": "2021-05-10T21:04:11.0480851Z",
  "principalDisplayName": "MyTestUser1",
  "principalId": "040f9599-7c0f-4f94-aa75-8394c4c6ea9b",
  "principalType": "User",
  "resourceDisplayName": "AWS Contoso",
  "resourceId": "a750f6cf-2319-464a-bcc3-456926736a91"
}

Paso 6: Obtener los metadatos SAML de Azure AD

Utilice la siguiente dirección URL para obtener los metadatos SAML de Azure AD para la aplicación configurada específica. Los metadatos contienen información como el certificado de firma, Azure AD entityID y Azure AD SingleSignOnService, entre otros.

https://login.microsoftonline.com/{tenant-id}/federationmetadata/2007-06/federationmetadata.xml?appid={app-id}

A continuación, se muestra un ejemplo aproximado de lo que verá para su aplicación:

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" ID="_05fbbf53-e892-43c9-9300-1f6738ace02c" entityID="https://sts.windows.net/2f82f566-5953-43f4-9251-79c6009bdf24/">
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">

...

<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://login.microsoftonline.com/2f82f566-5953-43f4-9251-79c6009bdf24/saml2"/>
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://login.microsoftonline.com/2f82f566-5953-43f4-9251-79c6009bdf24/saml2"/>
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://login.microsoftonline.com/2f82f566-5953-43f4-9251-79c6009bdf24/saml2"/>
</IDPSSODescriptor>
</EntityDescriptor>

Paso 7: Limpiar los recursos

En este paso, quitará los recursos que creó.

Eliminar la aplicación

Elimine la aplicación que creó.

Solicitud

DELETE https://graph.microsoft.com/v1.0/applications/a9be408a-6c31-4141-8cea-52fcd4a61be8


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

await graphClient.Applications["{application-id}"].DeleteAsync();



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)



graphClient.Applications().ByApplicationId("application-id").Delete(context.Background(), nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

graphClient.applications("a9be408a-6c31-4141-8cea-52fcd4a61be8")
	.buildRequest()
	.delete();


const options = {
	authProvider,
};

const client = Client.init(options);

await client.api('/applications/a9be408a-6c31-4141-8cea-52fcd4a61be8')
	.delete();


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);


$graphServiceClient->applications()->byApplicationId('application-id')->delete();


Import-Module Microsoft.Graph.Applications

Remove-MgApplication -ApplicationId $applicationId

Respuesta

HTTP/1.1 204 No Content

Elimine la cuenta de usuario

Elimine la cuenta de usuario MyTestUser1.

Solicitud

DELETE https://graph.microsoft.com/v1.0/users/040f9599-7c0f-4f94-aa75-8394c4c6ea9b


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

await graphClient.Users["{user-id}"].DeleteAsync();



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)



graphClient.Users().ByUserId("user-id").Delete(context.Background(), nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

graphClient.users("040f9599-7c0f-4f94-aa75-8394c4c6ea9b")
	.buildRequest()
	.delete();


const options = {
	authProvider,
};

const client = Client.init(options);

await client.api('/users/040f9599-7c0f-4f94-aa75-8394c4c6ea9b')
	.delete();


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);


$graphServiceClient->users()->byUserId('user-id')->delete();


Import-Module Microsoft.Graph.Users

Remove-MgUser -UserId $userId

Respuesta

HTTP/1.1 204 No Content

Eliminar la directiva de asignación de notificaciones

Eliminar la directiva de asignación de notificaciones.

Solicitud

DELETE https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/a4b35718-fd5e-4ca8-8248-a3c9934b1b78


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

await graphClient.Policies.ClaimsMappingPolicies["{claimsMappingPolicy-id}"].DeleteAsync();



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)



graphClient.Policies().ClaimsMappingPolicies().ByClaimsMappingPolicieId("claimsMappingPolicy-id").Delete(context.Background(), nil)


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

graphClient.policies().claimsMappingPolicies("a4b35718-fd5e-4ca8-8248-a3c9934b1b78")
	.buildRequest()
	.delete();


const options = {
	authProvider,
};

const client = Client.init(options);

await client.api('/policies/claimsMappingPolicies/a4b35718-fd5e-4ca8-8248-a3c9934b1b78')
	.delete();


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);


$graphServiceClient->policies()->claimsMappingPolicies()->byClaimsMappingPolicieId('claimsMappingPolicy-id')->delete();


Import-Module Microsoft.Graph.Identity.SignIns

Remove-MgPolicyClaimMappingPolicy -ClaimsMappingPolicyId $claimsMappingPolicyId

Respuesta

HTTP/1.1 204 No Content

Vea también

Para AWS, puede habilitar el aprovisionamiento de usuarios para obtener todos los roles de esa cuenta de AWS. Para más información, consulte Configurar la notificación de rol emitida en el token SAML
Personalizar las notificaciones emitidas en tokens para una determinada aplicación de un espacio empresarial.
Puede usar la API applicationTemplate para generar instancias de Aplicaciones situadas fuera de la Galería. Utilice applicationTemplateId 8adf8e6e-67b2-4cf2-a259-e3dc5476c621.
applicationTemplate
appRoleAssignment
servicePrincipal
application
claimsMappingPolicy
keyCredential
addTokenSigning Bookings

Configurar el inicio de sesión único basado en SAML para su aplicación con la API de Microsoft Graph

Requisitos previos

Paso 1: Crear la aplicación

Recupere el identificador de plantilla de la aplicación de la galería

Solicitud

Respuesta

Crear la aplicación

Solicitud

Respuesta

Paso 2: Configurar el inicio de sesión único

Solicitud

Respuesta

Establecer direcciones URL de SAML básicas

Solicitud

Respuesta

Agregar roles de aplicación (opcional)

Solicitud

Respuesta

Paso 3: Configurar la asignación de notificaciones

Crear una directiva de asignación de notificaciones

Solicitud

Respuesta

Asignar la directiva de asignación de notificaciones a la entidad de servicio

Solicitud

Respuesta

Paso 4: Configurar un certificado de firma

Opción 1: Creación de un certificado de firma en Azure AD

Solicitud

Respuesta

Opción 2: Crear un certificado de firma personalizado

Agregar una clave de firma personalizada

Solicitud

Respuesta

Activar la clave de firma personalizada

Solicitud

Respuesta

Paso 5: Asignar usuarios

Crear una cuenta de usuario

Solicitud

Respuesta

Asignar un usuario a la aplicación

Solicitud

Respuesta

Paso 6: Obtener los metadatos SAML de Azure AD

Paso 7: Limpiar los recursos

Eliminar la aplicación

Solicitud

Respuesta

Elimine la cuenta de usuario

Solicitud

Respuesta

Eliminar la directiva de asignación de notificaciones

Solicitud

Respuesta

Vea también

Recursos adicionales

Recursos adicionales