| title | customAuthenticationExtension: validateAuthenticationConfiguration |
|---|---|
| description | An API to check validity of the endpoint and authentication configuration for a customAuthenticationExtension. |
| author | soneff |
| ms.localizationpriority | medium |
| ms.subservice | entra-sign-in |
| doc_type | apiPageType |
| ms.date | 12/10/2024 |
Namespace: microsoft.graph
[!INCLUDE beta-disclaimer]
An API to check validity of the endpoint and and authentication configuration for a customAuthenticationExtension object, which can represent one of the following derived types:
- onTokenIssuanceStartCustomExtension resource type.
- onAttributeCollectionStartCustomExtension resource type.
- onAttributeCollectionSubmitCustomExtension resource type.
- onOtpSendCustomExtension resource type.
- onPasswordSubmitCustomExtension resource type.
[!INCLUDE national-cloud-support]
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.
[!INCLUDE permissions-table]
[!INCLUDE rbac-custom-auth-ext-apis-write]
To validate the endpoint and authentication configuration for a customAuthenticationExtension by its ID.
POST /identity/customAuthenticationExtensions/{customAuthenticationExtensionId}/validateAuthenticationConfigurationTo validate the endpoint and authentication configuration that's specified in the request body for a customAuthenticationExtension. The custom authentication extension object may not exist yet and you can use this endpoint to validate the configuration before creating the custom authentication extension.
POST /identity/customAuthenticationExtensions/validateAuthenticationConfiguration| Name | Description |
|---|---|
| Authorization | Bearer {token}. Required. Learn more about authentication and authorization. |
In the request body, supply JSON representation of the parameters.
The following table shows the parameters that can be used with this action. Supply a endpointConfiguration and authenticationConfiguration if querying at the root level. Otherwise, for a specific custom extension, Don't supply a request body for this method.
| Parameter | Type | Description |
|---|---|---|
| endpointConfiguration | customExtensionEndpointConfiguration | The HTTP endpoint for the custom authentication extension to be validated. |
| authenticationConfiguration | customExtensionEndpointConfiguration | The authentication configuration for the custom authenticaion extension to validate. |
If successful, this action returns a 200 OK response code and a authenticationConfigurationValidation in the response body.
The following example shows a request.
POST https://graph.microsoft.com/beta/customAuthenticationExtensions/validateAuthenticationConfiguration
Content-Type: application/json
{
"endpointConfiguration": {
"@odata.type": "#microsoft.graph.httpRequestEndpoint",
"targetUrl": "https://australia.contoso.com/users"
},
"authenticationConfiguration": {
"@odata.type": "#microsoft.graph.azureAdTokenAuthentication",
"resourceId": "api://extensibilityapi.azurwebsites.net/f9c5dc6b-d72b-4226-8ccd-801f7a290428"
}
}The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#microsoft.graph.authenticationConfigurationValidation",
"errors": [
{
"code": "IncorrectResourceIdFormat",
"message": "ResourceId should be in the format of 'api://{fully qualified domain name}/{appid}'"
},
{
"code": "DomainNameDoesNotMatch",
"message": "The fully qualified domain name in resourceId should match that of the targetUrl"
},
{
"code": "ServicePrincipalNotFound",
"message": "The appId of the resourceId should correspond to a real service principal in the tenant"
}
],
"warnings": [
{
"code": "PermissionNotGrantedToServicePrincipal",
"message": "The permission CustomAuthenticationExtensions.Receive.Payload is not granted to the service principal of the resource app"
},
]
}The following example shows a request.
POST https://graph.microsoft.com/beta/identity/customAuthenticationExtensions/9f39f3bb-457c-4a2a-8099-0e480e7ea142/validateAuthenticationConfiguration[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#microsoft.graph.authenticationConfigurationValidation",
"errors": [
{
"code": "IncorrectResourceIdFormat",
"message": "ResourceId should be in the format of 'api://{fully qualified domain name}/{appid}'"
},
{
"code": "DomainNameDoesNotMatch",
"message": "The fully qualified domain name in resourceId should match that of the targetUrl"
},
{
"code": "ServicePrincipalNotFound",
"message": "The appId of the resourceId should correspond to a real service principal in the tenant"
}
],
"warnings": [
{
"code": "PermissionNotGrantedToServicePrincipal",
"message": "The permission CustomAuthenticationExtensions.Receive.Payload is not granted to the service principal of the resource app"
},
]
}