Application Credentials with Certificate (Sign JWT with Private Key)
Description
Similar to Assplication-only access but with JWT sign with Private Key [API reference]
Instructions
Follow these simple steps below to create Microsoft Entra ID application with application access permissions. Using following steps, you can grant very granular app permissions to access File(s). Choose permission based on your need.
Create OAuth app
- Navigate to the Azure Portal and log in using your credentials.
- Access Microsoft Entra ID.
-
Register a new application by going to
App registrations
and clicking on New registration button:
INFO: Find more information on how to register an application in Graph API reference.
-
When configuration window opens, configure these fields:
-
Supported account type
- e.g. select
Accounts in this organizational directory only
if you need access to data in your organization only.
- e.g. select
-
Supported account type
-
After registering the app, copy the Application (client) ID for later:
-
Then copy OAuth authorization endpoint (v2) & OAuth token endpoint (v2) URLs:
Configure App Permissions
-
Continue by adding permissions for the app by going to the API permissions section, and clicking on Add a permission:
-
Select Microsoft Graph:
-
Then choose Application permissions option:
-
Continue by adding these Files (OneDrive) permissions (Just search for "Files" and then select desired permissions):
-
Finish by clicking Add permissions button:
-
Now it's time to Grant admin consent for your application:
-
Confirm all the permissions are granted:
Generate a Self-Signed Certificate
Now let's go through setting up a certificate-based authentication flow for Microsoft Graph or other Azure AD protected APIs using client credentials and a JWT.
You can use OpenSSL or any other way to generate Certificate file but to make it simple we will use below example PowerShell script.
Open PowerShell and execute code listed in below steps.
# Run this in PowerShell
#Change .AddYears(1) to desired number. By default it expires certificate in one year as per below code.
$cert = New-SelfSignedCertificate `
-Subject "CN=MyClientAppCert" `
-KeySpec Signature `
-KeyExportPolicy Exportable `
-KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" `
-KeyAlgorithm RSA `
-HashAlgorithm SHA256 `
-NotAfter (Get-Date).AddYears(1) `
-Provider "Microsoft Enhanced RSA and AES Cryptographic Provider"
# Export private key (.pfx) - Keep this with you to make API calls (SECRET KEY - DONOT SHARE)
$pfxPath = "$env:USERPROFILE\Desktop\private_key.pfx"
$pwd = ConvertTo-SecureString -String "yourStrongPassword123" -Force -AsPlainText
Export-PfxCertificate -Cert $cert -FilePath $pfxPath -Password $pwd
# Export public certificate (.cer) - UPLOAD this to Azure Portal
$cerPath = "$env:USERPROFILE\Desktop\public_key.cer"
Export-Certificate -Cert $cert -FilePath $cerPath
Upload the Certificate (i.e. Public Key *.cer)
Once we have certificate file generated.- In your App Registration, go to Certificates & secrets
- Under Certificates, click Upload certificate
- Select the
.cer
file (public certificate) - Click Select a file (Browse button)
- Select public key file (*.cer) from local machine and click OK to upload
Configure ZappySys Connection - Use private key (i.e. *.pfx or *.pem)
Now its time to use certificate pfx file (private key) generated in the previous step (NOTE: PFX file contains both private key and public key).-
Go to SSIS package or ODBC data source and use the copied values in Application Credentials authentication configuration:
- In the Token URL field paste the OAuth token endpoint (v2) URL value you copied in the previous step.
- In the Client ID field paste the Application (client) ID value you copied in the previous step.
- Configure private key
- go to
Certificate Tab - Change Storage Mode to
Disk File: *.pfx format (PKCS#12)
.NOTE: You can also useStored In LocalMachine
mode if PFX file already imported in the Local Certificate Storage Area - User Store OR Machine Store. If you used OpenSSL to generate key pair then useDisk File: *.pem format (PKCS#8 or PKCS#1)
Mode for Cert Store Location. - Supply the key file path
- Supply the certificate password (same password used in earlier PowerShell script)
- go to
- Now go back to General Tab, choose Default Group / User Id and Default Drive Id from the drop down menu.
- Click Test connection see everything is good
Parameters
Parameter | Required | Default value | Options | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Name: TokenUrl
Label: Token URL |
YES |
|
|||||||||
Name: ClientId
Label: Client ID |
YES | ||||||||||
Name: Certificate Label: Certificate: *** Configure [Client Certificate] Tab *** |
YES |
|
|||||||||
Name: GroupOrUserId Label: Default Group or User Id (additional Scopes needed to list - If fails enter manually) |
YES |
|
|||||||||
Name: DriveId Label: Default Drive Id |
YES | ||||||||||
Name: RetryMode Label: RetryMode |
RetryWhenStatusCodeMatch
|
|
|||||||||
Name: RetryStatusCodeList Label: RetryStatusCodeList |
429|503|423
|
||||||||||
Name: RetryCountMax Label: RetryCountMax |
5
|
||||||||||
Name: RetryMultiplyWaitTime Label: RetryMultiplyWaitTime |
True
|
||||||||||
Name: SearchOptionForNonIndexedFields Label: Search Option For Non-Indexed Fields (Default=Blank - Search Only Indexed) |
|
||||||||||
Name: ExtraHeaders Label: Extra Headers (e.g. Header1:AAA||Header2:BBB) |
|
||||||||||
Name: IsAppCred Label: IsAppCred |
1
|