[Network] az network application-gateway ssl-profile add/update: Expose client authentication mode

[spalabatla26]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Tests
⚠️ None	️✔️ 130/130

⚠️AzureCLI-BreakingChangeTest

⚠️network

rule	cmd_name	rule_message	suggest_message
⚠️ 1006 - ParaAdd	network application-gateway ssl-profile add	cmd network application-gateway ssl-profile add added parameter auth_configuration
⚠️ 1006 - ParaAdd	network application-gateway ssl-profile update	cmd network application-gateway ssl-profile update added parameter auth_configuration

Related command

• az network application-gateway ssl-profile add
• az network application-gateway ssl-profile update

Description

Expose the existing generated --auth-configuration object argument through the handwritten SSL-profile add/update wrappers so users can set verify-client-auth-mode=Passthrough|Strict.

The AAZ-generated commands already define the enum and serialize verify_client_auth_mode to properties.clientAuthConfiguration.verifyClientAuthMode in API 2025-07-01. However, both handwritten wrappers marked the object argument as unregistered. This change removes those two statements while preserving the existing Boolean client-authentication aliases.

• Add Passthrough examples to module help and handwritten AZ_HELP overrides. The overrides are needed because the generated command help takes precedence at runtime.
• Extend the existing SSL-profile ScenarioTest with Passthrough add, an independent GET, Strict update and independent GET, and an update back to Passthrough.
• Include a genuine live HTTP recording for offline replay; no generated aaz/ files were hand-edited and no recording responses were fabricated.
• Use TLS 1.2 in the scenario and explicitly pin the temporary gateway's SSL policy to AppGwSslPolicy20170401S on the first update. The legacy gateway-create path and newer update API otherwise use incompatible default policy families. This affects only test setup, not production command defaults.
• Add a Network history entry.

Testing Guide

Run from an activated Azure CLI development environment:

azdev test network --live --series -a -k test_network_app_gateway_with_ssl_profile
azdev test network --series -a -k test_network_app_gateway_with_ssl_profile
azdev linter --include-whl-extensions network
azdev style network
git diff --check

The live command creates billable temporary Azure resources and requires an appropriate test subscription. The replay command omits --live and uses the committed recording.

Observed validation results

Validation	Result
Live ScenarioTest	1 passed, 368 deselected in 721.45s (0:12:01); exit 0
Offline ScenarioTest replay	1 passed, 368 deselected in 482.52s (0:08:02)
Network linter	Linter: PASSED; no CLI or custom pylint rule violations
Network style	Pylint: PASSED, Flake8: PASSED
Whitespace check	git diff --check passed
Runtime help	Verified Passthrough example and explanation render for both add and update
Argument validation	Both commands expose --auth-configuration and reject Bogus with allowed values Passthrough and Strict
Generated PUT-content checks	4/4 passed: add/update x Passthrough/Strict; asserted API 2025-07-01; zero HTTP calls
Direct live CLI smoke test	Passthrough -> Strict -> Passthrough verified by independent GETs on an existing test gateway

Reviewable evidence

• Scenario assertions
• Genuine scenario recording

The cassette contains 99 HTTP interactions. A structured scan found verifyClientAuthMode in requests (Strict: 14, Passthrough: 2) and responses (Strict: 54, Passthrough: 7). Counts include existing profiles and repeated polling responses; they are not counts of independent test cases. The actual test subscription ID, user email, and Bearer marker were absent in the checks performed.

Temporary scenario resource-group deletion was confirmed complete. The previous default subscription was restored. The separate smoke-test profile was removed and its gateway returned to Succeeded with no SSL profiles.

Validation scope and caveats

• These checks validate CLI configuration parsing, serialization, service acceptance, and round trips. They do not validate client-certificate forwarding under traffic.
• Early recording attempts failed during SSL-policy setup; the committed cassette comes from the subsequent successful live run and passed offline replay.
• An initial replay invocation failed before tests because az was missing from PATH. Replay passed after activating the virtualenv.
• Local commit/push hooks skipped their checks because their shell was not activated. The explicit linter/style runs reported above were executed separately. The generated-operation check was an ad hoc offline check, not an additional committed unit test.
• Results above are local validation evidence, not a claim that GitHub CI has passed. The large YAML diff reflects the full scenario re-recording and additional interactions.

History Notes

[Network] az network application-gateway ssl-profile add/update: Expose --auth-configuration to support mTLS verify-client-auth-mode=Passthrough|Strict

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[microsoft-github-policy-service]

Thank you for your contribution spalabatla26! We will review the pull request and get back to you soon.

[Copilot]

🟢 Approval recommended

No unresolved blocking issues were identified, and validation covers the updated commands.

Pull request overview

This PR exposes mTLS client-authentication modes for application gateway SSL-profile commands.

Changes:

• Registers --auth-configuration for add/update.
• Adds Passthrough documentation and history.
• Extends scenario coverage for Passthrough/Strict transitions.

File summaries

File	Summary
src/azure-cli/HISTORY.rst	Documents the feature.
src/azure-cli/azure/cli/command_modules/network/tests/latest/test_network_commands.py	Tests authentication-mode transitions.
src/azure-cli/azure/cli/command_modules/network/custom.py	Exposes authentication configuration arguments.
src/azure-cli/azure/cli/command_modules/network/_help.py	Adds Passthrough help examples.

Review details

• Files reviewed: 4/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Yong Zhang (yonzhan)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Yong Zhang (yonzhan)]

Please fix CI issues

[spalabatla26]

@microsoft-github-policy-service agree company="Microsoft"

[Ethan Yang (necusjz)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Ethan Yang (necusjz)]

please revert it.