使用KeyVault和Azure PowerShell证书身份验证创建Azure AD应用程序

Question

Login-AzureRmAccount

$certPassword = ConvertTo-SecureString $CertPassword -AsPlainText -Force

$x509 = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList     $certPath,$certPassword

$credValue = [System.Convert]::ToBase64String($x509.GetRawCertData())

$adapp = New-AzureRmADApplication -DisplayName $ApplicationName -HomePage $URL -IdentifierUris $URL -CertValue $credValue -StartDate $startDate -EndDate $endDate     

$sp = New-AzureRmADServicePrincipal -ApplicationId $adapp.ApplicationId

Set-AzureRmKeyVaultAccessPolicy -VaultName $VaultName  -ServicePrincipalName $sp.ServicePrincipalNames[1] -PermissionsToKeys all –PermissionsToSecrets all -ResourceGroupName $ResourceGroupName

"keyCredentials": [{
      "customKeyIdentifier": null,
      "endDate": "2018-01-25T11:55:35.7680698Z",
      "keyId": "ca1e536c-2220-478b-af73-1198d125bb5f",
      "startDate": "2017-01-25T11:55:35.7680698Z",
      "type": "AsymmetricX509Cert",
      "usage": "Verify",
      "value": null
    } ]

证书是使用本地生成的makecert命令创建的自签名证书。我使用的是Powershell 2.0.1版本

用C#代码检索带有应用程序Id和拇指指纹的令牌

公共静态异步任务getAccessStoken（string authority,string resource,string scope）{var context=new AuthenticationContext（authority,TokenCache.DefaultShared）；var result=await context.AcquireTokenAsync（resource,AssertionCert）；return result.AccessStoken；}

谢谢：）

Answer 1

你看过这里的答案了吗？

使用Azure PowerShell证书身份验证在Azure AD中创建应用程序

在注释中，他提到CustomKeyIdentifier为null对于身份验证并不重要。

$cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cer.Import(“mycer.cer”)
$bin = $cer.GetCertHash()
$base64Thumbprint = [System.Convert]::ToBase64String($bin)