rage.fail

azure-app-federated-cred-trust-anchor

explicit azure emits TrustsExternalIdentity

match (record)

{ "field": "issuer", "resource_type": "microsoft.graph/applications/federatedIdentityCredentials" }

emit

source type	`ApplicationIdentity`
target type	`FederatedIdentity`
source	`<app registration that owns this federatedIdentityCredential>`
target	`<ExternalIdentity / FederatedIdentity node for this issuer+subject>`

Narrative

App registration {app.name} trusts external OIDC identity from issuer {issuer} with subject constraint '{subject}'. An identity satisfying this can obtain tokens as {app.name}'s service principal.

Raw rule rules/explicit/azure-managedidentity.yaml

id: azure-app-federated-cred-trust-anchor
emits: TrustsExternalIdentity
applies_to:
- azure
match_record:
  resource_type: microsoft.graph/applications/federatedIdentityCredentials
  field: issuer
emit:
  source_type: ApplicationIdentity
  target_type: FederatedIdentity
  source: <app registration that owns this federatedIdentityCredential>
  target: <ExternalIdentity / FederatedIdentity node for this issuer+subject>
  api_source: az ad app federated-credential list --id <appId>
  evidence_field: issuer, subject, audiences
  note: "Same semantics as azure-mi-federated-cred-trust-anchor but for app registrations (ApplicationIdentity).\
    \ The subject pin / breadth logic is identical. The CanModifyTrust path (adding a federated credential\
    \ to an app) is already captured in azure-federated-credential-write (identity-escalation.yaml) \u2014\
    \ this rule normalizes the TRUST FACT from the already-existing credential, not the write capability."
  narrative: App registration {app.name} trusts external OIDC identity from issuer {issuer} with subject
    constraint '{subject}'. An identity satisfying this can obtain tokens as {app.name}'s service principal.