Skip to content

Commit c160332

Browse files
DanielabomDanielabom
authored
Merge pull request #25827 from microsoftgraph/CRLFailSafeBeta
Added CRL validation in MSGraph doc for CBA
2 parents bbd36a0 + 571670a commit c160332

6 files changed

+98
-0
lines changed

‎api-reference/beta/api/x509certificateauthenticationmethodconfiguration-get.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,10 @@ Content-Type: application/json
136136
"issuerHintsConfiguration": {
137137
"state": "disabled"
138138
},
139+
"crlValidationConfiguration": {
140+
"state": "disabled",
141+
"exemptedCertificateAuthoritiesSubjectKeyIdentifiers": []
142+
},
139143
"includeTargets": [
140144
{
141145
"targetType": "group",

‎api-reference/beta/api/x509certificateauthenticationmethodconfiguration-update.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/x
4848
|:---|:---|:---|
4949
|authenticationModeConfiguration|[x509CertificateAuthenticationModeConfiguration](../resources/x509certificateauthenticationmodeconfiguration.md)|Defines strong authentication configurations. This configuration includes the default authentication mode and the different rules for strong authentication bindings. |
5050
|certificateUserBindings|[x509CertificateUserBinding](../resources/x509certificateuserbinding.md) collection|Defines fields in the X.509 certificate that map to attributes of the Microsoft Entra user object in order to bind the certificate to the user. The **priority** of the object determines the order in which the binding is carried out. The first binding that matches will be used and the rest ignored. |
51+
|crlValidationConfiguration|[x509CertificateCRLValidationConfiguration](../resources/x509certificatecrlvalidationconfiguration.md)|Determines whether certificate based authentication should fail if the issuing CA doesn't have a valid certificate revocation list configured. |
5152
|issuerHintsConfiguration|[x509CertificateIssuerHintsConfiguration](../resources/x509certificateissuerhintsconfiguration.md)|Determines whether issuer(CA) hints are sent back to the client side to filter the certificates shown in certificate picker. |
5253
|state|authenticationMethodState|The possible values are: `enabled`, `disabled`. |
5354

@@ -108,6 +109,10 @@ Content-Type: application/json
108109
"issuerHintsConfiguration": {
109110
"state": "disabled"
110111
},
112+
"crlValidationConfiguration": {
113+
"state": "disabled",
114+
"exemptedCertificateAuthoritiesSubjectKeyIdentifiers": []
115+
},
111116
"includeTargets": [
112117
{
113118
"targetType": "group",

‎api-reference/beta/resources/enums.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1853,6 +1853,14 @@ Namespace: microsoft.graph
18531853
| enabled |
18541854
| unknownFutureValue |
18551855

1856+
### x509CertificateCRLValidationConfigurationState values
1857+
1858+
| Member |
1859+
| ---- |
1860+
| disabled |
1861+
| enabled |
1862+
| unknownFutureValue |
1863+
18561864
### anniversaryType values
18571865

18581866
| Member |

‎api-reference/beta/resources/x509certificateauthenticationmethodconfiguration.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ Inherits from [authenticationMethodConfiguration](../resources/authenticationmet
3333
|:---|:---|:---|
3434
|authenticationModeConfiguration|[x509CertificateAuthenticationModeConfiguration](../resources/x509certificateauthenticationmodeconfiguration.md)|Defines strong authentication configurations. This configuration includes the default authentication mode and the different rules for strong authentication bindings. |
3535
|certificateUserBindings|[x509CertificateUserBinding](../resources/x509certificateuserbinding.md) collection|Defines fields in the X.509 certificate that map to attributes of the Microsoft Entra user object in order to bind the certificate to the user. The **priority** of the object determines the order in which the binding is carried out. The first binding that matches will be used and the rest ignored. |
36+
|crlValidationConfiguration|[x509CertificateCRLValidationConfiguration](../resources/x509certificatecrlvalidationconfiguration.md)|Determines whether certificate based authentication should fail if the issuing CA doesn't have a valid certificate revocation list configured. |
3637
|excludeTargets|[excludeTarget](../resources/excludetarget.md) collection|Groups of users that are excluded from the policy.|
3738
|id|String|The identifier for the authentication method policy. The value is always `X509Certificate`. Inherited from [authenticationMethodConfiguration](../resources/authenticationmethodconfiguration.md). |
3839
|issuerHintsConfiguration|[x509CertificateIssuerHintsConfiguration](../resources/x509certificateissuerhintsconfiguration.md)|Determines whether issuer(CA) hints are sent back to the client side to filter the certificates shown in certificate picker. |
@@ -74,6 +75,9 @@ The following is a JSON representation of the resource.
7475
},
7576
"issuerHintsConfiguration": {
7677
"@odata.type": "microsoft.graph.x509CertificateIssuerHintsConfiguration"
78+
},
79+
"crlValidationConfiguration": {
80+
"@odata.type": "microsoft.graph.x509CertificateCRLValidationConfiguration"
7781
}
7882
}
7983
```

‎api-reference/beta/resources/x509certificatecrlvalidationconfiguration.md

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
title: "x509CertificateCRLValidationConfiguration resource type"
3+
description: "Determines whether certificate-based authentication should fail if the issuing CA doesn't have a valid certificate revocation list (CRL) configured."
4+
author: "vimrang"
5+
ms.localizationpriority: medium
6+
ms.subservice: "entra-sign-in"
7+
doc_type: resourcePageType
8+
ms.date: 04/05/2024
9+
---
10+
11+
# x509CertificateCRLValidationConfiguration resource type
12+
13+
Namespace: microsoft.graph
14+
15+
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
16+
17+
Determines whether certificate-based authentication should fail if the issuing Certificate Authority (CA) doesn't have a valid certificate revocation list (CRL) configured. Includes the subject key identifier (SKI) of the CAs that should be exempted from CRL validation.
18+
19+
## Properties
20+
|Property|Type|Description|
21+
|:---|:---|:---|
22+
|exemptedCertificateAuthoritiesSubjectKeyIdentifiers| String collection|Represents the SKIs of CAs that should be excluded from the valid CRL distribution point check. SKI is represented as a hexadecimal string.|
23+
|state|x509CertificateCRLValidationConfigurationState|The possible values are: `disabled`, `enabled`, `unknownFutureValue`.|
24+
25+
## Relationships
26+
None.
27+
28+
## JSON representation
29+
The following JSON representation shows the resource type.
30+
<!-- {
31+
"blockType": "resource",
32+
"@odata.type": "microsoft.graph.x509CertificateCRLValidationConfiguration"
33+
}
34+
-->
35+
``` json
36+
{
37+
"@odata.type": "#microsoft.graph.x509CertificateCRLValidationConfiguration",
38+
"exemptedCertificateAuthoritiesSubjectKeyIdentifiers": [
39+
"String"
40+
],
41+
"state": "String"
42+
}
43+
```

‎changelog/Microsoft.AuthenticationMethodsPolicy.json

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,39 @@
11
{
22
"changelog": [
3+
{
4+
"ChangeList": [
5+
{
6+
"Id": "2cbecfbd-2d27-4fb9-bef3-294d2bb54e41",
7+
"ApiChange": "Enumeration",
8+
"ChangedApiName": "x509CertificateCRLValidationConfigurationState",
9+
"ChangeType": "Addition",
10+
"Description": "Added the **x509CertificateCRLValidationConfigurationState** enumeration type.",
11+
"Target": "x509CertificateCRLValidationConfigurationState"
12+
},
13+
{
14+
"Id": "2cbecfbd-2d27-4fb9-bef3-294d2bb54e41",
15+
"ApiChange": "Resource",
16+
"ChangedApiName": "x509CertificateCRLValidationConfiguration",
17+
"ChangeType": "Addition",
18+
"Description": "Added the [x509CertificateCRLValidationConfiguration](https://learn.microsoft.com/en-us/graph/api/resources/x509CertificateCRLValidationConfiguration?view=graph-rest-beta) resource.",
19+
"Target": "x509CertificateCRLValidationConfiguration"
20+
},
21+
{
22+
"Id": "2cbecfbd-2d27-4fb9-bef3-294d2bb54e41",
23+
"ApiChange": "Property",
24+
"ChangedApiName": "crlValidationConfiguration",
25+
"ChangeType": "Addition",
26+
"Description": "Added the **crlValidationConfiguration** property to the [x509CertificateAuthenticationMethodConfiguration](https://learn.microsoft.com/en-us/graph/api/resources/x509CertificateAuthenticationMethodConfiguration?view=graph-rest-beta) resource.",
27+
"Target": "x509CertificateAuthenticationMethodConfiguration"
28+
}
29+
],
30+
"Id": "2cbecfbd-2d27-4fb9-bef3-294d2bb54e41",
31+
"Cloud": "Prod",
32+
"Version": "beta",
33+
"CreatedDateTime": "2024-12-03T22:45:55.1918452Z",
34+
"WorkloadArea": "Identity and access",
35+
"SubArea": "Identity and sign-in"
36+
},
337
{
438
"ChangeList": [
539
{

0 commit comments

Comments
 (0)