az ad app update for app roles erases saml2Token optional claims

Describe the bug

I have application manifest that has optional claims that look like this:

{
  "optionalClaims": {
    "idToken": [],
    "accessToken": [],
    "saml2Token": [
      {
        "name": "groups",
        "source": null,
        "essential": false,
        "additionalProperties": ["sam_account_name"]
      }
    ]
  }
}

As far as I understood from other opened issues, this az-cli doesn’t support update of saml2Token

However!, when I update application roles (don’t do anything with optional claims), saml2Token gets erased:

{
  "optionalClaims": {
    "idToken": [],
    "accessToken": [],
    "saml2Token": []
  }
}

To Reproduce

Put something in optionalClaims.saml2Token

az ad app update --id <id> --app-roles @manifest.json

Verify optionalClaims.saml2Token is empty now

Expected behavior Well, changes in roles applied, and other fields shouldn’t be touched.

[jiasli]

I got your concern. This is definitely something that should be fixed. However, the reason is complicated (shown below).

As AD Graph API is already deprecated, we are not actively maintaining the REST spec anymore. az rest should be the right path.

Too long; don’t read

If you are interested, the code (introduced by #9616) is actually at

https://github.com/Azure/azure-cli/blob/74ea23bc805d57e3cf68cc9a4396141975acb580/src/azure-cli/azure/cli/command_modules/role/custom.py#L1037-L1043

which copies all existing properties into ApplicationUpdateParameters so that az ad app update complies with generic update, otherwise --remove will error out due to non-existing attribute.

saml2Token will be saved in additional_properties of the parent optional_claims attribute. However, as the SDK doesn’t define additional_properties for OptionalClaims like RequiredResourceAccess does,

OptionalClaims:

    _attribute_map = {
        'id_token': {'key': 'idToken', 'type': '[OptionalClaim]'},
        'access_token': {'key': 'accessToken', 'type': '[OptionalClaim]'},
        'saml_token': {'key': 'samlToken', 'type': '[OptionalClaim]'},
    }

RequiredResourceAccess:

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'resource_access': {'key': 'resourceAccess', 'type': '[ResourceAccess]'},
        'resource_app_id': {'key': 'resourceAppId', 'type': 'str'},
    }

saml2Token gets lost during serialization,

                if attr_name == "additional_properties" and attr_desc["key"] == '':
                    if target_obj.additional_properties is not None:
                        serialized.update(target_obj.additional_properties)
                    continue

therefore also lost when the application is patched back:

{
    "appRoles": [],
    ...
    "optionalClaims": {
        "idToken": [],
        "accessToken": []
    },
    ...
}

Possible Solutions

The REST spec of OptionalClaims should define either:

• saml2Token
• additional_properties

so that saml2Token can be preserved during az ad app update.

[AndriiOmelianenko]

@jiasli I see. I personally expected it to do something like a patch operation on approles only, without touching other parts of manifest.

for now I’ve doing workaround like this: az rest --method PATCH --uri https://graph.microsoft.com/v1.0/applications/{object_id} --headers Content-Type=application/json --body {"appRoles": {...}} and it works fine. it changes only approles in manifest, without changing anything else.