Skip to content

Commit daf6538

Browse files
huypubhuypub
authored
Merge pull request #74709 from MicrosoftDocs/master
4/25 AM Publish
2 parents f1cd389 + 5f84a4f commit daf6538

File tree

62 files changed

+575
-339
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

62 files changed

+575
-339
lines changed

‎articles/active-directory-b2c/active-directory-b2c-overview.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ ms.subservice: B2C
1515

1616
# What is Azure Active Directory B2C?
1717

18-
Azure Active Directory (Azure AD) B2C is an identity management service. This service enables you to customize and control how users securely interact with your web, desktop, mobile, or single-page applications. Using Azure AD B2C, users can sign up, sign in, reset passwords, and edit profiles. Azure AD B2C implements a form of the OpenID Connect and OAuth 2.0 protocols. The important key in the implementation of these protocols is the security tokens and their claims that enable you to provide secure access to resources.
18+
Azure Active Directory (Azure AD) B2C is a business-to-consumer identity management service. This service enables you to customize and control how users securely interact with your web, desktop, mobile, or single-page applications. Using Azure AD B2C, users can sign up, sign in, reset passwords, and edit profiles. Azure AD B2C implements a form of the OpenID Connect and OAuth 2.0 protocols. The important key in the implementation of these protocols is the security tokens and their claims that enable you to provide secure access to resources.
1919

2020
A *user journey* is a request that specifies a policy, which controls the behavior of how the user and your application interact with Azure AD B2C. Two paths are available to you for defining user journeys in Azure AD B2C.
2121

‎articles/active-directory/develop/access-tokens.md

+20-18
Large diffs are not rendered by default.

‎articles/active-directory/develop/active-directory-optional-claims.md

+1-2
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ The set of optional claims available by default for applications to use are list
5353
| `auth_time` | Time when the user last authenticated. See OpenID Connect spec.| JWT | | |
5454
| `tenant_region_scope` | Region of the resource tenant | JWT | | |
5555
| `home_oid` | For guest users, the object ID of the user in the user’s home tenant.| JWT | | |
56-
| `sid` | Session ID, used for per-session user sign out. | JWT | | |
56+
| `sid` | Session ID, used for per-session user sign out. | JWT | Personal and Azure AD accounts. | |
5757
| `platf` | Device platform | JWT | | Restricted to managed devices that can verify device type.|
5858
| `verified_primary_email` | Sourced from the user’s PrimaryAuthoritativeEmail | JWT | | |
5959
| `verified_secondary_email` | Sourced from the user’s SecondaryAuthoritativeEmail | JWT | | |
@@ -87,7 +87,6 @@ These claims are always included in v1.0 Azure AD tokens, but not included in v2
8787
| `family_name` | Last Name | Provides the last name, surname, or family name of the user as defined in the user object. <br>"family_name":"Miller" | Supported in MSA and AAD |
8888
| `given_name` | First name | Provides the first or "given" name of the user, as set on the user object.<br>"given_name": "Frank" | Supported in MSA and AAD |
8989
| `upn` | User Principal Name | An identifer for the user that can be used with the username_hint parameter. Not a durable identifier for the user and should not be used to key data. | See [additional properties](#additional-properties-of-optional-claims) below for configuration of the claim. |
90-
| `sid` | Session ID | GUID session identifier, used for tracking authentication session with MSA. | MSA only. Will not be included for Azure AD accounts. |
9190

9291

9392
### Additional properties of optional claims

‎articles/aks/configure-kubenet.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ az aks create \
161161
--client-secret <password>
162162
```
163163

164-
When you create an AKS cluster, a network security group and route table are created. These network resources are managed by the AKS control plane and automatically associated with your virtual network subnet, and are updated as you create and expose services.
164+
When you create an AKS cluster, a network security group and route table are created. These network resources are managed by the AKS control plane. The network security group is automatically associated with the virtual NICs on your nodes. The route table is automatically associated with the virtual network subnet. Network security group rules and route tables and are automatically updated as you create and expose services.
165165

166166
## Next steps
167167

‎articles/aks/operator-best-practices-identity.md

+3-2
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: iainfoulds
66

77
ms.service: container-service
88
ms.topic: conceptual
9-
ms.date: 11/26/2018
9+
ms.date: 04/24/2019
1010
ms.author: iainfou
1111
---
1212

@@ -104,7 +104,8 @@ In the following example, a developer creates a pod that uses a managed identity
104104
1. A developer deploys a pod with a managed identity that requests an access token through the NMI server.
105105
1. The token is returned to the pod and used to access an Azure SQL Server instance.
106106
107-
Managed pod identities is an AKS open source project, and is not supported by Azure technical support. It is provided to gather feedback and bugs from our community. The project is not recommended for production use.
107+
> [!NOTE]
108+
> Managed pod identities is an open source project, and is not supported by Azure technical support.
108109
109110
To use pod identities, see [Azure Active Directory identities for Kubernetes applications][aad-pod-identity].
110111

‎articles/api-management/api-management-security-attributes.md

+8
Original file line numberDiff line numberDiff line change
@@ -64,3 +64,11 @@ Security is integrated into every aspect of an Azure service. This article docum
6464
| Security Attribute | Yes/No | Notes|
6565
|---|---|--|
6666
| Configuration management support (versioning of configuration, etc.)| Yes | Using the [Azure API Management DevOps Resource Kit](https://aka.ms/apimdevops) |
67+
68+
## Vulnerability scans false positives
69+
70+
This section documents common vulnerabilities, which do not affect Azure API Management.
71+
72+
| Vulnerability | Description |
73+
|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
74+
| Ticketbleed (CVE-2016-9244) | Ticketbleed is vulnerability in the implementation of the TLS SessionTicket extension found in some F5 products. It allows the leakage ("bleeding") of up to 31 bytes of data from uninitialized memory. This is caused by the TLS stack padding a Session ID, passed from the client, with data to make it 32-bits long. |

0 commit comments

Comments
 (0)