Skip to content

Failure response from New-MgApplication with -KeyCredentials switch and $cert.RawData specified since version 2.26.0 #3170

@gosec-mh

Description

@gosec-mh

Describe the bug

Since version 2.26.0, i am getting an error when attempting to create an App Registration including the -KeyCredentials switch with $cert.RawData set, using New-MgApplication.

$appRegistration = New-MgApplication -DisplayName $AppName -SignInAudience "AzureADMyOrg" -Web @{ RedirectUris = "http:///localhost:1337"; } -RequiredResourceAccess $RequiredResourceAccess -AdditionalProperties @{} -KeyCredentials @(@{ Type = "AsymmetricX509Cert"; Usage = "Verify"; Key = $cert.RawData })
New-MgApplication_CreateExpanded: Cannot convert the literal 'MIIDIjCCAgqgAwIBAgIQH4Firsm0X6dEJOiDrrcTQDANBgkqhkiG9w0BAQsFADAkMSIwIAYDVQQDDBlhdWRpdC1nb3NlY3VyaXR5LTIwMjUwMjI0MB4XDTI1MDIyNDEyMTExOVoXDTI1MDgyNDEyMjEyMFowJDEiMCAGA1UEAwwZYXVkaXQtZ29zZWN1cml0eS0yMDI1MDIyNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKqwc+2Tk+mu2fgmmwlkPB97hUjfhtAuuHl5qBm7KFPHOkXWb1kK3ANbughY7pxiyypepli7lE8X0KcnUUHe6BtuPJ8BKiks3xF3LVltmGonbAQFYUkuU9+an7Jdb9UPLNFZGCClx5ZNPuYLTawjkcMJWJ5JK8YKdVJoCzlF5rVZfsQwsIHmdzXOQ41SSyh9Qhz05QIw4xQjBC+cMdipZuof9aKqudvKcmybP+P5gUL3ZQZg+AE2pkn99UyUP7gMnsQNxX3vvkoYp5ZyBbHNYzKdZBtLq13aXTl4AlvQ3Zaqyt8icUmjkC8leXWKIlCH2ZwjMRwONiM7pHGYUCAwEAAaNQME4wDgYDVR0PAQHBAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUL1scYkR53fFRDD1Y+LbR9wcw2sYwDQYJKoZIhvcNAQELBQADggEBAGuDmL1PMaNlM+BxJt9VKKMeQRoRqBAjoVC5tjXmtBR68pTwgmjh5nPUs8PF57L0nIyLPDJVC9ahTIEhB+BCV+UtBlCPHpoudNJUhBbqNfZbYEy1eG65I4AIF8sLBupRPaliqmpDnDL4vYg8TtrWa5GU5kBvIroQDuV0bghNSFQJeNmVZoC9USmWyr3j9CruRHGlp5avjPNYM6lIZ6y0cgmv4ohV2NJbzMYOmmL4luqsRbOOw9HAq0WSEvSXgLvPKOF3PNocAatitHdHz1+sKWNfp574o1mb6tEUG0y0...' to the expected type 'Edm.Binary'.

Status: 400 (BadRequest)
ErrorCode: Request_BadRequest
Date: 2025-02-24T13:03:36

Headers:
Cache-Control                 : no-cache
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : c5133d3f-dab7-4430-b3da-d864391b7b52
client-request-id             : 64110a54-4b94-4987-96d8-e288daf11c66
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"Switzerland North","Slice":"E","Ring":"3","ScaleUnit":"002","RoleInstance":"ZR2PEPF000000CA"}}
x-ms-resource-unit            : 1
Date                          : Mon, 24 Feb 2025 13:03:36 GMT

Expected behavior

The app registration to be created without an error.

How to reproduce

Create an App Registration and execute the below script:

Connect-MgGraph -Scopes 'Application.ReadWrite.All' -TenantId ""
$appName = "myApp"
$certName = ("myCert").ToLower().Replace(" ", "")
$cert = Get-ChildItem -Path cert:\CurrentUser\my\ | Where-Object { $_.subject -eq "CN=$certName" }

$appRegistration = New-MgApplication -DisplayName $AppName -SignInAudience "AzureADMyOrg" -Web @{ RedirectUris = "http:///localhost:1337"; } -KeyCredentials @(@{ Type = "AsymmetricX509Cert"; Usage = "Verify"; Key = $cert.RawData })

SDK Version

2.26.0

Latest version known to work for scenario above?

2.25.0

Known Workarounds

No response

Debug output

Click to expand log ```
</details>


### Configuration

_No response_

### Other information

_No response_

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions