search

AzureAD / azure-activedirectory-library-for-python

ADAL for Python
http://adal-python.readthedocs.io
Other
259 stars 94 forks source link

Subject Name/Issuer Authentication? #225

Closed mbearup closed 4 years ago

mbearup commented 4 years ago

I'm attempting to use Subject Name/Issuer authentication (with a Service Principal) to enable automatic rotation of secrets, The API allegedly supports this by supplying an optional public_certificate parameter, however...

  1. When I supply this parameter, I get an error indicating that the parameter must contain "BEGIN PRIVATE KEY". This seems unusual since all we really need is the subject name/SAN.
  2. When I provide the full public/private key I still get a login error...

Is there some special way this parameter must be provided, or a preferred ADAL version? Thanks,

mbearup commented 4 years ago

Looks like this was due to using an old version of ADAL. However, I now get error AADSTS700027 -"The provided signature value did not match the expected signature value." It seems to thing my cert is valid from year 0000 to 9999 which is not the case...

mbearup commented 4 years ago

The latest issue was because I was passing the entire chain, which caused the CA (first in the chain) to be parsed. Perhaps we should update the docs to clarify that only the leaf cert (in PEM/str format) should be passed.