105304 fix null error azure app sp2

AzureEnterpriseApplicationOrchestrator.Tests/AzureEnterpriseApplicationOrchestrator.Tests.csproj

@@ -11,8 +11,11 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Logging" Version="8.0.0" />
     <PackageReference Include="Microsoft.Graph" Version="5.54.0" />
+    <PackageReference Include="Microsoft.Kiota.Abstractions" Version="1.22.0" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.1.0" />
     <PackageReference Include="NLog.Extensions.Logging" Version="5.3.8" />
+    <PackageReference Include="System.Net.Http" Version="4.3.4" />
+    <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
     <PackageReference Include="xunit" Version="2.4.1" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.4.3">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

AzureEnterpriseApplicationOrchestrator/AzureEnterpriseApplicationOrchestrator.csproj

@@ -16,13 +16,15 @@
         <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
         <PrivateAssets>all</PrivateAssets>
       </PackageReference>
-      <PackageReference Include="Keyfactor.Logging" Version="1.1.0" Condition="'$(TargetFramework)' == 'net6.0'"/>
-      <PackageReference Include="Keyfactor.Logging" Version="1.3.0" Condition="'$(TargetFramework)' == 'net8.0'"/>
-      <PackageReference Include="Keyfactor.Logging" Version="1.3.0" Condition="'$(TargetFramework)' == 'net10.0'"/>
+      <PackageReference Include="Keyfactor.Logging" Version="1.1.0" Condition="'$(TargetFramework)' == 'net6.0'" />
+      <PackageReference Include="Keyfactor.Logging" Version="1.3.0" Condition="'$(TargetFramework)' == 'net8.0'" />
+      <PackageReference Include="Keyfactor.Logging" Version="1.3.0" Condition="'$(TargetFramework)' == 'net10.0'" />
       <PackageReference Include="Keyfactor.Orchestrators.Common" Version="3.4.0" />
       <PackageReference Include="Keyfactor.Orchestrators.IOrchestratorJobExtensions" Version="1.0.0" />
       <PackageReference Include="Microsoft.Graph" Version="5.54.0" />
+      <PackageReference Include="Microsoft.Kiota.Abstractions" Version="1.22.0" />
       <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
+      <PackageReference Include="runtime.native.System.Net.Http" Version="4.3.1" />
       <PackageReference Include="System.Drawing.Common" Version="9.0.0" />
     </ItemGroup>
 

AzureEnterpriseApplicationOrchestrator/AzureSP2Jobs/Inventory.cs

@@ -105,5 +105,4 @@ public JobResult ProcessJob(InventoryJobConfiguration config, SubmitInventoryUpd
 
         return result;
     }
-}
-
+}

AzureEnterpriseApplicationOrchestrator/Client/GraphClient.cs

@@ -122,7 +122,7 @@
                     _azureCloudEndpoint = AzureAuthorityHosts.AzureChina;
                     break;
                 case "germany":
                     _azureCloudEndpoint = AzureAuthorityHosts.AzureGermany;
                     break;
                 case "government":
                     _azureCloudEndpoint = AzureAuthorityHosts.AzureGovernment;
@@ -800,17 +800,58 @@
 
         foreach (KeyCredential keyCredential in keyCredentials)
         {
-            string customKeyIdentifier = Convert.ToHexString(keyCredential.CustomKeyIdentifier);
+            // CustomKeyIdentifier can be null for key credentials returned by Graph. Fall back to the
+            // KeyId so that the credential can still be tracked and reported instead of throwing.
+            string customKeyIdentifier;
+            if (keyCredential.CustomKeyIdentifier != null)
+            {
+                customKeyIdentifier = Convert.ToHexString(keyCredential.CustomKeyIdentifier);
+            }
+            else if (keyCredential.KeyId != null)
+            {
+                customKeyIdentifier = keyCredential.KeyId.ToString();
+                _logger.LogWarning($"Key credential with DisplayName \"{keyCredential.DisplayName}\" has no CustomKeyIdentifier - using KeyId \"{customKeyIdentifier}\" instead");
+            }
+            else
+            {
+                _logger.LogWarning($"Skipping key credential with DisplayName \"{keyCredential.DisplayName}\" because it has neither a CustomKeyIdentifier nor a KeyId");
+                continue;
+            }
 
-            if (!string.IsNullOrWhiteSpace(keyCredential.Usage) && keyCredential.Usage.Equals("Sign", StringComparison.OrdinalIgnoreCase))
+            if (!string.IsNullOrWhiteSpace(keyCredential.Usage))
             {
                 _logger.LogDebug($"Certificate with CustomKeyIdentifier \"{customKeyIdentifier}\" has a private key entry");
                 privateKeyMap[customKeyIdentifier] = true;
             }
             // We only track the case where the private key exists because there will be several keyCredentials
             // for Service Principals where one is the certificate and the other is the private key.
 
-            X509Certificate2 certificate = GetCertificateFromKeyCredential(keyCredential);
+            // If the thumbprint is already in the map, skip it
+            if (keyIdMap.ContainsKey(customKeyIdentifier))
+            {
+                _logger.LogTrace($"Skipping certificate with CustomKeyIdentifier \"{customKeyIdentifier}\" because it's already in the inventory");
+                continue;
+            }
+
+            X509Certificate2 certificate;
+            try
+            {
+                certificate = GetCertificateFromKeyCredential(keyCredential);
+            }
+            catch (Exception ex)
+            {
+                string message = $"Exception retrieving certificate for key credential with DisplayName \"{keyCredential.DisplayName}\" ({customKeyIdentifier}): {ex.Message}";
+                _logger.LogWarning(message);
+                failedCertificateMap[customKeyIdentifier] = message;
+                continue;
+            }
+
+            if (!string.Equals(keyCredential.Type, "AsymmetricX509Cert", StringComparison.OrdinalIgnoreCase))
+            {
+                _logger.LogDebug($"Skipping key credential with DisplayName \"{keyCredential.DisplayName}\" because its type is \"{keyCredential.Type}\", not a certificate");
+                continue;
+            }
+
             if (certificate == null)
             {
                 string message = $"Unable to retrieve certificate for key credential with DisplayName \"{keyCredential.DisplayName}\" ({customKeyIdentifier})";
@@ -824,12 +865,6 @@
                 failedCertificateMap.Remove(customKeyIdentifier);
             }
 
-            // If the thumbprint is already in the map, skip it
-            if (keyIdMap.ContainsKey(customKeyIdentifier))
-            {
-                _logger.LogTrace($"Skipping certificate with CustomKeyIdentifier \"{customKeyIdentifier}\" because it's already in the inventory");
-                continue;
-            }
             keyIdMap[customKeyIdentifier] = true;
 
             // Assemble the certificates for the inventory
@@ -967,7 +1002,9 @@
 
     protected X509Certificate2 GetCertificateFromKeyCredential(KeyCredential keyCredential)
     {
-        string customKeyIdentifier = Encoding.UTF8.GetString(keyCredential.CustomKeyIdentifier);
+        string customKeyIdentifier = keyCredential.CustomKeyIdentifier != null
+            ? Encoding.UTF8.GetString(keyCredential.CustomKeyIdentifier)
+            : keyCredential.KeyId?.ToString() ?? "unknown";
         if (keyCredential.Key == null || keyCredential.Key.Length == 0)
         {
             _logger.LogWarning($"Key credential with KeyId \"{keyCredential.KeyId}\" has no key data");

CHANGELOG.md

@@ -1,3 +1,6 @@
+- 4.2.1
+  - Resolved an error when performing inventory on AzureAppSP2 when getting the Application Certificates indicating a value cannot be null in the Array returned from the graph.
+
 - 4.2.0
   - Added PAM Support for Azure App Registrations and Service Principals.
   - Updated logging to remove sensitive information.