Skip to content

Commit 77ef503

Browse files
HemantErappaHemant Imudianda
HemantErappa
and
Hemant Imudianda
authored
Application Gateway Mutual Authentication Support (#9965)
* Adding mutual auth api definitions. * Adding examples. * Fixing case. Co-authored-by: Hemant Imudianda <[email protected]>
1 parent c96cf26 commit 77ef503

File tree

3 files changed

+268
-0
lines changed

3 files changed

+268
-0
lines changed

‎specification/network/resource-manager/Microsoft.Network/stable/2020-06-01/applicationGateway.json‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1361,6 +1361,15 @@
13611361
},
13621362
"description": "Application Gateway Ssl policy."
13631363
},
1364+
"ApplicationGatewayClientAuthConfiguration": {
1365+
"properties": {
1366+
"verifyClientCertIssuerDN": {
1367+
"type": "boolean",
1368+
"description": "Verify client certificate issuer name on the application gateway."
1369+
}
1370+
},
1371+
"description": "Application gateway client authentication configuration."
1372+
},
13641373
"ApplicationGatewayIPConfigurationPropertiesFormat": {
13651374
"properties": {
13661375
"subnet": {
@@ -1494,6 +1503,49 @@
14941503
],
14951504
"description": "Trusted Root certificates of an application gateway."
14961505
},
1506+
"ApplicationGatewayTrustedClientCertificatePropertiesFormat": {
1507+
"properties": {
1508+
"data": {
1509+
"type": "string",
1510+
"description": "Certificate public data."
1511+
},
1512+
"provisioningState": {
1513+
"readOnly": true,
1514+
"$ref": "./network.json#/definitions/ProvisioningState",
1515+
"description": "The provisioning state of the trusted client certificate resource."
1516+
}
1517+
},
1518+
"description": "Trusted client certificates properties of an application gateway."
1519+
},
1520+
"ApplicationGatewayTrustedClientCertificate": {
1521+
"properties": {
1522+
"properties": {
1523+
"x-ms-client-flatten": true,
1524+
"$ref": "#/definitions/ApplicationGatewayTrustedClientCertificatePropertiesFormat",
1525+
"description": "Properties of the application gateway trusted client certificate."
1526+
},
1527+
"name": {
1528+
"type": "string",
1529+
"description": "Name of the trusted client certificate that is unique within an Application Gateway."
1530+
},
1531+
"etag": {
1532+
"readOnly": true,
1533+
"type": "string",
1534+
"description": "A unique read-only string that changes whenever the resource is updated."
1535+
},
1536+
"type": {
1537+
"readOnly": true,
1538+
"type": "string",
1539+
"description": "Type of the resource."
1540+
}
1541+
},
1542+
"allOf": [
1543+
{
1544+
"$ref": "./network.json#/definitions/SubResource"
1545+
}
1546+
],
1547+
"description": "Trusted client certificates of an application gateway."
1548+
},
14971549
"ApplicationGatewaySslCertificatePropertiesFormat": {
14981550
"properties": {
14991551
"data": {
@@ -1827,6 +1879,60 @@
18271879
],
18281880
"description": "Backend address pool settings of an application gateway."
18291881
},
1882+
"ApplicationGatewaySslProfilePropertiesFormat": {
1883+
"properties": {
1884+
"trustedClientCertificates": {
1885+
"type": "array",
1886+
"items": {
1887+
"$ref": "./network.json#/definitions/SubResource"
1888+
},
1889+
"description": "Array of references to application gateway trusted client certificates."
1890+
},
1891+
"sslPolicy": {
1892+
"$ref": "#/definitions/ApplicationGatewaySslPolicy",
1893+
"description": "SSL policy of the application gateway resource."
1894+
},
1895+
"clientAuthConfiguration": {
1896+
"$ref": "#/definitions/ApplicationGatewayClientAuthConfiguration",
1897+
"description": "Client authentication configuration of the application gateway resource."
1898+
},
1899+
"provisioningState": {
1900+
"readOnly": true,
1901+
"$ref": "./network.json#/definitions/ProvisioningState",
1902+
"description": "The provisioning state of the HTTP listener resource."
1903+
}
1904+
},
1905+
"description": "Properties of SSL profile of an application gateway."
1906+
},
1907+
"ApplicationGatewaySslProfile": {
1908+
"properties": {
1909+
"properties": {
1910+
"x-ms-client-flatten": true,
1911+
"$ref": "#/definitions/ApplicationGatewaySslProfilePropertiesFormat",
1912+
"description": "Properties of the application gateway SSL profile."
1913+
},
1914+
"name": {
1915+
"type": "string",
1916+
"description": "Name of the SSL profile that is unique within an Application Gateway."
1917+
},
1918+
"etag": {
1919+
"readOnly": true,
1920+
"type": "string",
1921+
"description": "A unique read-only string that changes whenever the resource is updated."
1922+
},
1923+
"type": {
1924+
"readOnly": true,
1925+
"type": "string",
1926+
"description": "Type of the resource."
1927+
}
1928+
},
1929+
"allOf": [
1930+
{
1931+
"$ref": "./network.json#/definitions/SubResource"
1932+
}
1933+
],
1934+
"description": "SSL profile of an application gateway."
1935+
},
18301936
"ApplicationGatewayHttpListenerPropertiesFormat": {
18311937
"properties": {
18321938
"frontendIPConfiguration": {
@@ -1849,6 +1955,10 @@
18491955
"$ref": "./network.json#/definitions/SubResource",
18501956
"description": "SSL certificate resource of an application gateway."
18511957
},
1958+
"sslProfile": {
1959+
"$ref": "./network.json#/definitions/SubResource",
1960+
"description": "SSL profile resource of the application gateway."
1961+
},
18521962
"requireServerNameIndication": {
18531963
"type": "boolean",
18541964
"description": "Applicable only if protocol is https. Enables SNI for multi-hosting."
@@ -2662,6 +2772,13 @@
26622772
},
26632773
"description": "Trusted Root certificates of the application gateway resource. For default limits, see [Application Gateway limits](https://docs.microsoft.com/azure/azure-subscription-service-limits#application-gateway-limits)."
26642774
},
2775+
"trustedClientCertificates": {
2776+
"type": "array",
2777+
"items": {
2778+
"$ref": "#/definitions/ApplicationGatewayTrustedClientCertificate"
2779+
},
2780+
"description": "Trusted client certificates of the application gateway resource. For default limits, see [Application Gateway limits](https://docs.microsoft.com/azure/azure-subscription-service-limits#application-gateway-limits)."
2781+
},
26652782
"sslCertificates": {
26662783
"type": "array",
26672784
"items": {
@@ -2711,6 +2828,13 @@
27112828
},
27122829
"description": "Http listeners of the application gateway resource. For default limits, see [Application Gateway limits](https://docs.microsoft.com/azure/azure-subscription-service-limits#application-gateway-limits)."
27132830
},
2831+
"sslProfiles": {
2832+
"type": "array",
2833+
"items": {
2834+
"$ref": "#/definitions/ApplicationGatewaySslProfile"
2835+
},
2836+
"description": "SSL profiles of the application gateway resource. For default limits, see [Application Gateway limits](https://docs.microsoft.com/azure/azure-subscription-service-limits#application-gateway-limits)."
2837+
},
27142838
"urlPathMaps": {
27152839
"type": "array",
27162840
"items": {

‎specification/network/resource-manager/Microsoft.Network/stable/2020-06-01/examples/ApplicationGatewayCreate.json‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,14 @@
5757
}
5858
}
5959
],
60+
"trustedClientCertificates": [
61+
{
62+
"name": "clientcert",
63+
"properties": {
64+
"data": "****"
65+
}
66+
}
67+
],
6068
"frontendIPConfigurations": [
6169
{
6270
"name": "appgwfip",
@@ -107,6 +115,28 @@
107115
}
108116
}
109117
],
118+
"sslProfiles": [
119+
{
120+
"name": "sslProfile1",
121+
"properties": {
122+
"sslPolicy": {
123+
"policyType": "Custom",
124+
"minProtocolVersion": "TLSv1_1",
125+
"cipherSuites": [
126+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
127+
]
128+
},
129+
"clientAuthConfiguration": {
130+
"verifyClientCertIssuerDN": true
131+
},
132+
"trustedClientCertificates": [
133+
{
134+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/trustedClientCertificates/clientcert"
135+
}
136+
]
137+
}
138+
}
139+
],
110140
"httpListeners": [
111141
{
112142
"name": "appgwhl",
@@ -121,6 +151,9 @@
121151
"sslCertificate": {
122152
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/sslCertificates/sslcert"
123153
},
154+
"sslProfile": {
155+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/sslProfiles/sslProfile1"
156+
},
124157
"requireServerNameIndication": false
125158
}
126159
},
@@ -285,6 +318,16 @@
285318
}
286319
}
287320
],
321+
"trustedClientCertificates": [
322+
{
323+
"name": "clientcert",
324+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/trustedClientCertificates/clientcert",
325+
"properties": {
326+
"provisioningState": "Succeeded",
327+
"data": "****"
328+
}
329+
}
330+
],
288331
"authenticationCertificates": [],
289332
"frontendIPConfigurations": [
290333
{
@@ -340,6 +383,30 @@
340383
}
341384
}
342385
],
386+
"sslProfiles": [
387+
{
388+
"name": "sslProfile1",
389+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/sslProfiles/sslProfile1",
390+
"properties": {
391+
"provisioningState": "Succeeded",
392+
"sslPolicy": {
393+
"policyType": "Custom",
394+
"minProtocolVersion": "TLSv1_1",
395+
"cipherSuites": [
396+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
397+
]
398+
},
399+
"clientAuthConfiguration": {
400+
"verifyClientCertIssuerDN": true
401+
},
402+
"trustedClientCertificates": [
403+
{
404+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/trustedClientCertificates/clientcert"
405+
}
406+
]
407+
}
408+
}
409+
],
343410
"httpListeners": [
344411
{
345412
"name": "appgwhl",
@@ -356,6 +423,9 @@
356423
"sslCertificate": {
357424
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/sslCertificates/sslcert"
358425
},
426+
"sslProfile": {
427+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/sslProfiles/sslProfile1"
428+
},
359429
"requireServerNameIndication": false
360430
}
361431
},
@@ -531,6 +601,16 @@
531601
}
532602
}
533603
],
604+
"trustedClientCertificates": [
605+
{
606+
"name": "clientcert",
607+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/trustedClientCertificates/clientcert",
608+
"properties": {
609+
"provisioningState": "Succeeded",
610+
"data": "****"
611+
}
612+
}
613+
],
534614
"authenticationCertificates": [],
535615
"frontendIPConfigurations": [
536616
{
@@ -589,6 +669,30 @@
589669
}
590670
}
591671
],
672+
"sslProfiles": [
673+
{
674+
"name": "sslProfile1",
675+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/sslProfiles/sslProfile1",
676+
"properties": {
677+
"provisioningState": "Succeeded",
678+
"sslPolicy": {
679+
"policyType": "Custom",
680+
"minProtocolVersion": "TLSv1_1",
681+
"cipherSuites": [
682+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
683+
]
684+
},
685+
"clientAuthConfiguration": {
686+
"verifyClientCertIssuerDN": true
687+
},
688+
"trustedClientCertificates": [
689+
{
690+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/trustedClientCertificates/clientcert"
691+
}
692+
]
693+
}
694+
}
695+
],
592696
"httpListeners": [
593697
{
594698
"name": "appgwhl",
@@ -605,6 +709,9 @@
605709
"sslCertificate": {
606710
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/sslCertificates/sslcert"
607711
},
712+
"sslProfile": {
713+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/sslProfiles/sslProfile1"
714+
},
608715
"requireServerNameIndication": false
609716
}
610717
},

‎specification/network/resource-manager/Microsoft.Network/stable/2020-06-01/examples/ApplicationGatewayGet.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,16 @@
4242
}
4343
}
4444
],
45+
"trustedClientCertificates": [
46+
{
47+
"name": "clientcert",
48+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/trustedClientCertificates/clientcert",
49+
"properties": {
50+
"provisioningState": "Succeeded",
51+
"data": "****"
52+
}
53+
}
54+
],
4555
"authenticationCertificates": [],
4656
"frontendIPConfigurations": [
4757
{
@@ -97,6 +107,30 @@
97107
}
98108
}
99109
],
110+
"sslProfiles": [
111+
{
112+
"name": "sslProfile1",
113+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/sslProfiles/sslProfile1",
114+
"properties": {
115+
"provisioningState": "Succeeded",
116+
"sslPolicy": {
117+
"policyType": "Custom",
118+
"minProtocolVersion": "TLSv1_1",
119+
"cipherSuites": [
120+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
121+
]
122+
},
123+
"clientAuthConfiguration": {
124+
"verifyClientCertIssuerDN": true
125+
},
126+
"trustedClientCertificates": [
127+
{
128+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/trustedClientCertificates/clientcert"
129+
}
130+
]
131+
}
132+
}
133+
],
100134
"httpListeners": [
101135
{
102136
"name": "appgwhl",
@@ -113,6 +147,9 @@
113147
"sslCertificate": {
114148
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/sslCertificates/sslcert"
115149
},
150+
"sslProfile": {
151+
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/sslProfiles/sslProfile1"
152+
},
116153
"requireServerNameIndication": false
117154
}
118155
},

0 commit comments

Comments
 (0)