Remove-MgApplicationKey - 删除过期的应用注册证书

Question

我正在从 AzureAD 模块更新我当前的脚本，并想更新一个删除过期应用程序注册证书的脚本。

我可以使用新模块删除过期的机密，但是新命令 Remove-MgApplicationKey 需要根据 Microsoft 文档提供证明： https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/remove- mgapplicationkey?view=graph-powershell-1.0 。 （作为此方法的请求验证的一部分，在执行操作之前验证现有密钥的所有权证明）。

`$params = @{
    KeyId = "f0b0b335-1d71-4883-8f98-567911bfdca6"
    Proof = "eyJ0eXAiOiJ..."
}
Remove-MgApplicationKey -ApplicationId $applicationId -BodyParameter $params`

关于如何在 PowerShell 中对此进行编码的任何建议？

谢谢。

来自 Microsoft 文档的 C# 示例： https://learn.microsoft.com/en-us/graph/application-rollkey-prooftoken

Answer 1

代码看起来像这样

using assembly System;
using assembly System.Security.Cryptography.X509Certificates;

# Configure the following
$pfxFilePath = "<Path to your certificate file";
$password = "<Certificate password>";
$objectId = "<id of the application or servicePrincipal object>";

# Get signing certificate
#$signingCert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new([string]$pfxFilePath, [string]$password);
#$signingCert = [System.Security.Cryptography.X509Certificates]::X509Certificate2($pfxFilePath, $password);
$signingCert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new();
$signingCert.CreateFromEncryptedPemFile($pfxFilePath, $password, $null)
#$signingCert | Format-Table
#$signingCert.filename = $pfxFilePath;
#$signingCert.password = $password;
# audience
$aud = "00000002-0000-0000-c000-000000000000";

#aud and iss are the only required claims.
$claims = [System.Collections.Generic.Dictionary[string, object]]::new()
$claims.Add("aud", $aud)
$claims.Add("iss", $objectId)

#token validity should not be more than 10 minutes
$now = [DateTime]::UtcNow;
$securityTokenDescriptor = New-Object [System.Security.Cryptography.X509Certificates.SecurityTokenDescriptor]::new()

    $securityTokenDescriptor.Claims = $claims,
    $securityTokenDescriptor.NotBefore = $now,
    $securityTokenDescriptor.Expires = $now.AddMinutes(10),
    $securityTokenDescriptor.SigningCredentials = New-Object X509SigningCredentials($signingCert);


$handler = [Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler]::new();
$x = handler.CreateToken($securityTokenDescriptor);
Write-Host x;