Missing powershell commands for complex APIs

[aimalpan]

Hi, powershell commands for the below APIs are missing in our documentation here: https://learn.microsoft.com/en-us/graph/api/resources/authenticationeventsflow?view=graph-rest-beta

Under Userflows for Azure AD for customers (Preview):

1. All APIs under Identity Providers
2. All APIs under Authentication Condition Applications
3. List attributes, add attributes and remove attributes under User flow Attributes

Attaching the screenshots for clarity:

Could you please help generate the powershell commands for the one missing and also make sure that the example from HTTPs is translated as well?

[irvinesunday]

Just got a few things I need clarity on here:

Taking a look at this path:
GET /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/

externalUsersSelfServiceSignUpEventsFlow is a child of authenticationEventsFlow and thus why we currently do not expand into the properties contained within the child externalUsersSelfServiceSignUpEventsFlow. Currently we generate the below path:
/identity/authenticationEventsFlows/{authenticationEventsFlow-id}

The question would be, are we expecting to expand into the children of a base type entity here? The child here being externalUsersSelfServiceSignUpEventsFlow and the parent (base type) is authenticationEventsFlow. I would think otherwise. This would violate the principle of inheritance. See doc. reference. If not, is this a case of bad API design?

We currently do expand into the properties (structural and navigation) of the parent (base type) of the entity type in other scenarios.

For example:

Given the path: /directory/certificateAuthorities/certificateBasedApplicationConfigurations/{certificateBasedApplicationConfiguration-id}/trustedCertificateAuthorities

cc: @darrelmiller @baywet @peombwa

[irvinesunday]

Here's another question regarding the path:
/identity/authenticationEventsFlows/{authenticationEventsFlow-id}/conditions/applications/includeApplications/

applications is a complex property contained in the entity type authenticationConditions which is the type for the complex property conditions.
By adding a ReadRestrictions property to the complex property conditions, we can generate the path: /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/conditions

However we cannot expand into the entity type of this complex property. We only expand containment navigation properties.

Complex types are keyless nominal structured types. The lack of a key means that complex types cannot be referenced, created, updated or deleted independently of an entity type

Doc. reference

Hence this path is not feasible: /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/conditions/applications

Thoughts?
cc: @darrelmiller @baywet

[baywet]

@irvinesunday I'm not sure I understand your comment about poor API design. Looking at this path with the metadata

/identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/

for each segment we get:

• singleton of type identity identityContainer
• nav prop of type collection of authenticationEventsFlow
• indexing into the collection
• downcast to externalUsersSelfServiceSignUpEventsFlow
• property externalUsersSelfServiceSignUpEventsFlow of the cast type, of type onAuthenticationMethodLoadStartHandler
• downcast to onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp
• property identityProviders of the cast type

Which to me respects OData semantics, type cast segments are added to navigation properties so properties of the cast type can be accessed. We're never accessing a property from the base type after a type cast segment.
The only thing from our conversion conventions is that we might be inverting the indexer and type cast segments.

Did I miss anything?

[irvinesunday]

@irvinesunday I'm not sure I understand your comment about poor API design. Looking at this path with the metadata

/identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/

for each segment we get:

• singleton of type identity identityContainer
• nav prop of type collection of authenticationEventsFlow
• indexing into the collection
• downcast to externalUsersSelfServiceSignUpEventsFlow
• property externalUsersSelfServiceSignUpEventsFlow of the cast type, of type onAuthenticationMethodLoadStartHandler
• downcast to onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp
• property identityProviders of the cast type

Which to me respects OData semantics, type cast segments are added to navigation properties so properties of the cast type can be accessed. We're never accessing a property from the base type after a type cast segment. The only thing from our conversion conventions is that we might be inverting the indexer and type cast segments.

Did I miss anything?

From the above clarification, to achieve the expected paths below:

1. GET /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/
2. POST /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/$ref
3. DELETE /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/$ref
   Question: Should the above path be:
   DELETE /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/{identityProviderBase-id}/$ref
   (i.e., indexing into the identityProviders collection before deleting the $ref)
4. GET /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAttributeCollection/microsoft.graph.onAttributeCollectionExternalUsersSelfServiceSignUp/attributes
5. POST /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAttributeCollection/microsoft.graph.onAttributeCollectionExternalUsersSelfServiceSignUp/attributes/$ref
6. DELETE /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAttributeCollection/microsoft.graph.onAttributeCollectionExternalUsersSelfServiceSignUp/attributes/$ref

The below annotations will need to be added:

<NavigationProperty Name="authenticationEventsFlows" Type="Collection(graph.authenticationEventsFlow)" ContainsTarget="true">
  <Annotation Term="Org.OData.Validation.V1.DerivedTypeConstraint">
    <Collection>
      <String>microsoft.graph.externalUsersSelfServiceSignUpEventsFlow</String>
    </Collection>
  </Annotation>
</NavigationProperty>

<EntityType Name="externalUsersSelfServiceSignUpEventsFlow" BaseType="graph.authenticationEventsFlow">
  <Property Name="onAttributeCollection" Type="graph.onAttributeCollectionHandler">
  <Annotation Term="Org.OData.Validation.V1.DerivedTypeConstraint">
      <Collection>
        <String>microsoft.graph.onAttributeCollectionExternalUsersSelfServiceSignUp</String>
      </Collection>
    </Annotation>
    <Annotation Term="Org.OData.Capabilities.V1.ReadRestrictions">
      <Record>
        <PropertyValue Property="Readable" Bool="true" />
      </Record>
    </Annotation>    
  </Property>
  <Property Name="onAuthenticationMethodLoadStart" Type="graph.onAuthenticationMethodLoadStartHandler">
    <Annotation Term="Org.OData.Validation.V1.DerivedTypeConstraint">
      <Collection>
        <String>microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp</String>
      </Collection>
    </Annotation>
    <Annotation Term="Org.OData.Capabilities.V1.ReadRestrictions">
      <Record>
        <PropertyValue Property="Readable" Bool="true" />
      </Record>
    </Annotation>
  </Property>
</EntityType>

<ComplexType Name="onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp" BaseType="graph.onAuthenticationMethodLoadStartHandler">
  <NavigationProperty Name="identityProviders" Type="Collection(graph.identityProviderBase)">
    <Annotation Term="Org.OData.Capabilities.V1.NavigationRestrictions">
      <Record>
        <PropertyValue Property="Referenceable" Bool="true" />
      </Record>
    </Annotation>
  </NavigationProperty>
</ComplexType>

The conversion lib will also need to be updated to retrieve complex properties of derived types. This issue will track this work: microsoft/OpenAPI.NET.OData#437

[irvinesunday]

Re-opening issue as 3 of the mentioned APIs are still not yet completed.

[microsoft-github-policy-service]

Hello @aimalpan

Thank you for reporting your concern. If you report this issue in the Microsoft Q&A forum, it will get routed to the appropriate team for them to triage.
https://aka.ms/askgraph
This issue will now be closed.