AuthenticationProviderProperties Class

Properties for authentication provider configuration. A policy must configure either JWT validation fields or user sign-in fields; the two configurations are mutually exclusive and cannot be combined.

Constructor

AuthenticationProviderProperties(*args: Any, **kwargs: Any)

Variables

Name Description
issuer
str

The absolute HTTPS URL of the Secure Token Service. Include a trailing slash at the end of the value. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/. Required.
jwks_uri
str

The JSON Web Key Set (JWKS) URI used to retrieve the public keys for JWT validation. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/discovery/v2.0/keys.
audience
str

The intended audience for the JWT. Only a single audience value is supported in this API version. Example: https://audience.com/{application-id}.
client_id
str

The Application (client) ID for the related application registered in Microsoft Entra ID, formatted as a GUID. Required.
client_secret
str

The absolute HTTPS Key Vault secret URL identifying the client secret used for authentication. This property is required for user sign-in policies. It holds only the Key Vault reference; the secret value itself is never accepted or returned by this API and is read from Key Vault at runtime using the resource's user-assigned identity. The secret value stored in Key Vault can contain up to 4096 characters. Example: https://myvault.vault.azure.net/secrets/mysecret.
scope
list[str]

The scopes used by an application during authentication to authorize access to a user's details. A maximum of 10 scopes is supported, each scope can contain up to 128 characters, and all scopes can contain up to 256 characters combined.
session_timeout
str

The timeout of the session cookie used for user authentication. The service accepts and returns this value as a string containing a base-10 unsigned integer number of seconds with no sign, decimal point, unit suffix, or whitespace (for example 86400). The supported range is 1 to 604800 seconds, and the default is 86400 seconds. Applicable to the Application Gateway post-OIDC workflow.
session_cookie_name
str

The name of the session cookie used for user authentication. Applicable to the Application Gateway post-OIDC workflow.

Attributes

audience

The intended audience for the JWT. Only a single audience value is supported in this API version. Example: https://audience.com/{application-id}.

audience: str | None

client_id

The Application (client) ID for the related application registered in Microsoft Entra ID, formatted as a GUID. Required.

client_id: str

client_secret

The absolute HTTPS Key Vault secret URL identifying the client secret used for authentication. This property is required for user sign-in policies. It holds only the Key Vault reference; the secret value itself is never accepted or returned by this API and is read from Key Vault at runtime using the resource's user-assigned identity. The secret value stored in Key Vault can contain up to 4096 characters. Example: https://myvault.vault.azure.net/secrets/mysecret.

client_secret: str | None

issuer

The absolute HTTPS URL of the Secure Token Service. Include a trailing slash at the end of the value. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/. Required.

issuer: str

jwks_uri

The JSON Web Key Set (JWKS) URI used to retrieve the public keys for JWT validation. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/discovery/v2.0/keys.

jwks_uri: str | None

scope

The scopes used by an application during authentication to authorize access to a user's details. A maximum of 10 scopes is supported, each scope can contain up to 128 characters, and all scopes can contain up to 256 characters combined.

scope: list[str] | None

The name of the session cookie used for user authentication. Applicable to the Application Gateway post-OIDC workflow.

session_cookie_name: str | None

session_timeout

The timeout of the session cookie used for user authentication. The service accepts and returns this value as a string containing a base-10 unsigned integer number of seconds with no sign, decimal point, unit suffix, or whitespace (for example 86400). The supported range is 1 to 604800 seconds, and the default is 86400 seconds. Applicable to the Application Gateway post-OIDC workflow.

session_timeout: str | None