Preserve VerifyClientAuthMode in Application Gateway client auth configuration by paraboys · Pull Request #29854 · Azure/azure-powershell

paraboys · 2026-07-15T18:07:50Z

Description

This PR fixes the missing VerifyClientAuthMode property in the PowerShell model for Application Gateway client authentication configuration.

Changes made

Added the missing VerifyClientAuthMode property to PSApplicationGatewayClientAuthConfiguration.
Updated AutoMapper mappings between:
- PSApplicationGatewayClientAuthConfiguration → ApplicationGatewayClientAuthConfiguration
- ApplicationGatewayClientAuthConfiguration → PSApplicationGatewayClientAuthConfiguration
Ensured that VerifyClientAuthMode is preserved during conversions between PowerShell and SDK models.

Impact

Previously, VerifyClientAuthMode was not available in the PowerShell model, causing the value to be lost during PowerShell object conversions. As a result, Application Gateway configurations using Passthrough mode could unintentionally be updated to the default Strict mode during read-modify-write operations.

This change preserves the original VerifyClientAuthMode value and prevents unintended configuration changes.

Fixes #29540.

Mandatory Checklist

General release
Public preview
Private preview
Engineering build
No need for a release
Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

Updated ChangeLog.md appropriately (if required).
Regenerated markdown help files (not required since there is no cmdlet API change).
Added/updated test coverage for the change.
Did not manually adjust the module version.

…nfiguration

azure-client-tools-bot-prd · 2026-07-15T18:08:43Z

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

azure-pipelines · 2026-07-15T18:08:50Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

microsoft-github-policy-service · 2026-07-15T18:10:09Z

Thank you for your contribution @paraboys! We will review the pull request and get back to you soon.

paraboys · 2026-07-15T18:11:23Z

@microsoft-github-policy-service agree

Copilot

Pull request overview

This PR addresses an Application Gateway idempotency issue in Az.Network by adding the missing VerifyClientAuthMode field to the PowerShell model and ensuring it round-trips correctly between PowerShell and the Network SDK model during read/modify/write operations.

Changes:

Added VerifyClientAuthMode to PSApplicationGatewayClientAuthConfiguration.
Updated AutoMapper mappings in NetworkResourceManagerProfile to map VerifyClientAuthMode both PS→SDK and SDK→PS.
Preserved the client auth mode value during conversions to prevent unintended drift (e.g., Passthrough reverting to Strict).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
`src/Network/Network/Models/PSApplicationGatewayClientAuthConfiguration.cs`	Adds the missing `VerifyClientAuthMode` property to the PS model so the value can be retained across conversions.
`src/Network/Network/Common/NetworkResourceManagerProfile.cs`	Extends AutoMapper mappings to include `VerifyClientAuthMode` in both directions (PS↔SDK).

    {
        public bool? VerifyClientCertIssuerDN { get; set; }
        public string VerifyClientRevocation { get; set; }
+        public string VerifyClientAuthMode { get; set; }


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

+               cfg.CreateMap<CNM.PSApplicationGatewayClientAuthConfiguration,MNM.ApplicationGatewayClientAuthConfiguration>()
+               .ForMember(
+                  dest => dest.VerifyClientCertIssuerDn,
+                  opt => opt.MapFrom(src => src.VerifyClientCertIssuerDN)
+                  )
+               .ForMember(
+                  dest => dest.VerifyClientAuthMode,
+                  opt => opt.MapFrom(src => src.VerifyClientAuthMode)
+                  );


        public bool? VerifyClientCertIssuerDN { get; set; }
        public string VerifyClientRevocation { get; set; }
+        public string VerifyClientAuthMode { get; set; }


Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

paraboys · 2026-07-16T05:06:07Z

    public class PSApplicationGatewayClientAuthConfiguration
    {
        public bool? VerifyClientCertIssuerDN { get; set; }
        public string VerifyClientRevocation { get; set; }
+        public string VerifyClientAuthMode { get; set; }


Thanks for the suggestion. The reported issue (#29540) is caused by the missing property in the PowerShell model and the SDK↔PS mappings during Get-AzApplicationGateway/Set-AzApplicationGateway round-trips. NewObject() is not part of that flow, so I kept this PR focused on the reported issue. I can address cmdlet parameter support separately if needed

+                cfg.CreateMap<CNM.PSApplicationGatewayClientAuthConfiguration, MNM.ApplicationGatewayClientAuthConfiguration>()
+                    .ForMember(
+                        dest => dest.VerifyClientCertIssuerDn,
+                        opt => opt.MapFrom(src => src.VerifyClientCertIssuerDN)
+                    )
+                    .ForMember(
+                        dest => dest.VerifyClientAuthMode,
+                        opt => opt.MapFrom(src => src.VerifyClientAuthMode)
+                    );


VeryEarly

please revisit changes in NetworkResourceManagerProfile.cs. The diff shouldn't be the entire file

VeryEarly · 2026-07-19T13:19:57Z

meanwhile please also update https://github.com/paraboys/azure-powershell/blob/paraboys-patch-1/src/Network/Network/ChangeLog.md
briefly summarise release note for this change in past tense under Upcoming Release

paraboys · 2026-07-20T16:39:38Z

Hi @VeryEarly , thanks for the review and feedback.

I created a new PR (#29861) with a clean minimal diff that addresses the feedback regarding the full-file changes in NetworkResourceManagerProfile.cs.

Could you please review the new PR instead? I'll close this PR.

paraboys added 2 commits July 15, 2026 23:19

Add VerifyClientAuthMode mapping to client auth config

8557d43

Add VerifyClientAuthMode property to PSApplicationGatewayClientAuthCo…

e909e31

…nfiguration

Copilot AI review requested due to automatic review settings July 15, 2026 18:07

Copilot started reviewing on behalf of paraboys July 15, 2026 18:08 View session

microsoft-github-policy-service Bot added the customer-reported label Jul 15, 2026

Copilot AI reviewed Jul 15, 2026

View reviewed changes

Potential fix for pull request finding

d4c74e1

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 15, 2026 18:48

Copilot started reviewing on behalf of paraboys July 15, 2026 18:49 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

Refactor mapping configurations for client auth indentation

06ada0b

Copilot AI review requested due to automatic review settings July 15, 2026 19:17

Copilot started reviewing on behalf of paraboys July 15, 2026 19:18 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

VeryEarly self-assigned this Jul 19, 2026

VeryEarly requested changes Jul 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Preserve VerifyClientAuthMode in Application Gateway client auth configuration#29854

Preserve VerifyClientAuthMode in Application Gateway client auth configuration#29854
paraboys wants to merge 4 commits into
Azure:mainfrom
paraboys:paraboys-patch-1

paraboys commented Jul 15, 2026

Uh oh!

azure-client-tools-bot-prd Bot commented Jul 15, 2026

Uh oh!

azure-pipelines Bot commented Jul 15, 2026

Uh oh!

microsoft-github-policy-service Bot commented Jul 15, 2026

Uh oh!

paraboys commented Jul 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

paraboys Jul 16, 2026

Uh oh!

VeryEarly left a comment

Uh oh!

VeryEarly commented Jul 19, 2026

Uh oh!

paraboys commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

paraboys commented Jul 15, 2026

Description

Changes made

Impact

Mandatory Checklist

Uh oh!

azure-client-tools-bot-prd Bot commented Jul 15, 2026

Uh oh!

azure-pipelines Bot commented Jul 15, 2026

Uh oh!

microsoft-github-policy-service Bot commented Jul 15, 2026

Uh oh!

paraboys commented Jul 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

paraboys Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

VeryEarly left a comment

Choose a reason for hiding this comment

Uh oh!

VeryEarly commented Jul 19, 2026

Uh oh!

paraboys commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants