Skip to content

Commit 9d07c03

Browse files
mnriemmnriem
authored
End to End TLS SSL - step #9 - add Azure AD authentication URL (Azure#17074)
* Added Azure AD authentication URL
1 parent c2dc73c commit 9d07c03

File tree

12 files changed

+97
-48
lines changed

12 files changed

+97
-48
lines changed

‎sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/AuthClient.java‎

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
// Copyright (c) Microsoft Corporation. All rights reserved.
22
// Licensed under the MIT License.
3-
43
package com.azure.security.keyvault.jca;
54

65
import com.azure.security.keyvault.jca.model.OAuthToken;
@@ -50,7 +49,7 @@ class AuthClient extends DelegateRestClient {
5049
* Stores the OAuth2 managed identity URL.
5150
*/
5251
private static final String OAUTH2_MANAGED_IDENTITY_TOKEN_URL
53-
= "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01";
52+
= "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01";
5453

5554
/**
5655
* Stores our logger.
@@ -96,23 +95,24 @@ public String getAccessToken(String resource, String identity) {
9695
* @param clientSecret the client secret.
9796
* @return the authorization token.
9897
*/
99-
public String getAccessToken(String resource, String tenantId,
100-
String clientId, String clientSecret) {
101-
LOGGER.entering("AuthClient", "getAccessToken", new Object[] {
102-
resource, tenantId, clientId, clientSecret });
98+
public String getAccessToken(String resource, String aadAuthenticationUrl,
99+
String tenantId, String clientId, String clientSecret) {
100+
101+
LOGGER.entering("AuthClient", "getAccessToken", new Object[]{
102+
resource, tenantId, clientId, clientSecret});
103103
LOGGER.info("Getting access token using client ID / client secret");
104104
String result = null;
105105

106106
StringBuilder oauth2Url = new StringBuilder();
107-
oauth2Url.append(OAUTH2_TOKEN_BASE_URL)
108-
.append(tenantId)
109-
.append(OAUTH2_TOKEN_POSTFIX);
107+
oauth2Url.append(aadAuthenticationUrl == null ? OAUTH2_TOKEN_BASE_URL : aadAuthenticationUrl)
108+
.append(tenantId)
109+
.append(OAUTH2_TOKEN_POSTFIX);
110110

111111
StringBuilder requestBody = new StringBuilder();
112112
requestBody.append(GRANT_TYPE_FRAGMENT)
113-
.append(CLIENT_ID_FRAGMENT).append(clientId)
114-
.append(CLIENT_SECRET_FRAGMENT).append(clientSecret)
115-
.append(RESOURCE_FRAGMENT).append(resource);
113+
.append(CLIENT_ID_FRAGMENT).append(clientId)
114+
.append(CLIENT_SECRET_FRAGMENT).append(clientSecret)
115+
.append(RESOURCE_FRAGMENT).append(resource);
116116

117117
String body = post(oauth2Url.toString(), requestBody.toString(), "application/x-www-form-urlencoded");
118118
if (body != null) {
@@ -143,7 +143,6 @@ private String getAccessTokenOnAppService(String resource, String identity) {
143143
url.append(System.getenv("MSI_ENDPOINT"))
144144
.append("?api-version=2017-09-01")
145145
.append(RESOURCE_FRAGMENT).append(resource);
146-
147146
if (identity != null) {
148147
url.append("&objectid=").append(identity);
149148
}
@@ -175,13 +174,11 @@ private String getAccessTokenOnOthers(String resource, String identity) {
175174
if (identity != null) {
176175
LOGGER.log(INFO, "Using managed identity with object ID: {0}", identity);
177176
}
178-
179177
String result = null;
180178

181179
StringBuilder url = new StringBuilder();
182180
url.append(OAUTH2_MANAGED_IDENTITY_TOKEN_URL)
183181
.append(RESOURCE_FRAGMENT).append(resource);
184-
185182
if (identity != null) {
186183
url.append("&object_id=").append(identity);
187184
}

‎sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultClient.java‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,12 @@ class KeyVaultClient extends DelegateRestClient {
5858
*/
5959
private final String keyVaultUrl;
6060

61+
/**
62+
* Stores the AAD authentication URL (or null to default to Azure Public
63+
* Cloud).
64+
*/
65+
private String aadAuthenticationUrl;
66+
6167
/**
6268
* Stores the tenant ID.
6369
*/
@@ -113,12 +119,15 @@ class KeyVaultClient extends DelegateRestClient {
113119
* Constructor.
114120
*
115121
* @param keyVaultUri the Azure Key Vault URI.
122+
* @param aadAuthenticationUrl the Azure AD authentication URL.
116123
* @param tenantId the tenant ID.
117124
* @param clientId the client ID.
118125
* @param clientSecret the client secret.
119126
*/
120-
KeyVaultClient(final String keyVaultUri, final String tenantId, final String clientId, final String clientSecret) {
127+
KeyVaultClient(final String keyVaultUri, final String aadAuthenticationUrl,
128+
final String tenantId, final String clientId, final String clientSecret) {
121129
this(keyVaultUri);
130+
this.aadAuthenticationUrl = aadAuthenticationUrl;
122131
this.tenantId = tenantId;
123132
this.clientId = clientId;
124133
this.clientSecret = clientSecret;
@@ -141,7 +150,7 @@ private String getAccessToken() {
141150
}
142151

143152
if (tenantId != null && clientId != null && clientSecret != null) {
144-
accessToken = authClient.getAccessToken(resource, tenantId, clientId, clientSecret);
153+
accessToken = authClient.getAccessToken(resource, aadAuthenticationUrl, tenantId, clientId, clientSecret);
145154
} else {
146155
accessToken = authClient.getAccessToken(resource, managedIdentity);
147156
}
@@ -295,10 +304,9 @@ Key getKey(String alias, char[] password) {
295304
* @throws IOException when an I/O error occurs.
296305
* @throws NoSuchAlgorithmException when algorithm is unavailable.
297306
* @throws InvalidKeySpecException when the private key cannot be generated.
298-
*/
307+
* */
299308
private PrivateKey createPrivateKeyFromPem(String pemString)
300309
throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {
301-
302310
StringBuilder builder = new StringBuilder();
303311
try (BufferedReader reader = new BufferedReader(new StringReader(pemString))) {
304312
String line = reader.readLine();

‎sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultKeyStore.java‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -71,22 +71,25 @@ public final class KeyVaultKeyStore extends KeyStoreSpi {
7171
*
7272
* <p>
7373
* The constructor uses System.getProperty for
74-
* <code>azure.keyvault.uri</code>, <code>azure.keyvault.tenantId</code>,
74+
* <code>azure.keyvault.uri</code>,
75+
* <code>azure.keyvault.aadAuthenticationUrl</code>,
76+
* <code>azure.keyvault.tenantId</code>,
7577
* <code>azure.keyvault.clientId</code>,
7678
* <code>azure.keyvault.clientSecret</code> and
77-
* <code>azure.keyvault.userAssignedIdentity</code> to initialize the
78-
* keyvault client.
79+
* <code>azure.keyvault.managedIdentity</code> to initialize the
80+
* Key Vault client.
7981
* </p>
8082
*/
8183
public KeyVaultKeyStore() {
8284
creationDate = new Date();
8385
String keyVaultUri = System.getProperty("azure.keyvault.uri");
86+
String aadAuthenticationUrl = System.getProperty("azure.keyvault.aadAuthenticationUrl");
8487
String tenantId = System.getProperty("azure.keyvault.tenantId");
8588
String clientId = System.getProperty("azure.keyvault.clientId");
8689
String clientSecret = System.getProperty("azure.keyvault.clientSecret");
8790
String managedIdentity = System.getProperty("azure.keyvault.managedIdentity");
8891
if (clientId != null) {
89-
keyVaultClient = new KeyVaultClient(keyVaultUri, tenantId, clientId, clientSecret);
92+
keyVaultClient = new KeyVaultClient(keyVaultUri, aadAuthenticationUrl, tenantId, clientId, clientSecret);
9093
} else {
9194
keyVaultClient = new KeyVaultClient(keyVaultUri, managedIdentity);
9295
}
@@ -210,13 +213,14 @@ public void engineLoad(KeyStore.LoadStoreParameter param) {
210213
if (parameter.getClientId() != null) {
211214
keyVaultClient = new KeyVaultClient(
212215
parameter.getUri(),
216+
parameter.getAadAuthenticationUrl(),
213217
parameter.getTenantId(),
214218
parameter.getClientId(),
215219
parameter.getClientSecret());
216-
} else if (parameter.getUserAssignedIdentity() != null) {
220+
} else if (parameter.getManagedIdentity() != null) {
217221
keyVaultClient = new KeyVaultClient(
218222
parameter.getUri(),
219-
parameter.getUserAssignedIdentity()
223+
parameter.getManagedIdentity()
220224
);
221225
} else {
222226
keyVaultClient = new KeyVaultClient(parameter.getUri());

‎sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultLoadStoreParameter.java‎

Lines changed: 35 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@ public class KeyVaultLoadStoreParameter implements KeyStore.LoadStoreParameter {
1414
* Stores the URI.
1515
*/
1616
private final String uri;
17+
18+
/**
19+
* Stores the Azure AD authentication URL.
20+
*/
21+
private final String aadAuthenticationUrl;
1722

1823
/**
1924
* Stores the tenant id.
@@ -33,36 +38,40 @@ public class KeyVaultLoadStoreParameter implements KeyStore.LoadStoreParameter {
3338
/**
3439
* Stores the user-assigned identity.
3540
*/
36-
private final String userAssignedIdentity;
41+
private final String managedIdentity;
3742

3843
/**
3944
* Constructor.
4045
*
4146
* @param uri the Azure Key Vault URI.
47+
* @param aadAuthenticationUrl the Azure AD authentication URL.
4248
* @param tenantId the tenant ID.
4349
* @param clientId the client ID.
4450
* @param clientSecret the client secret.
4551
*/
46-
public KeyVaultLoadStoreParameter(String uri, String tenantId, String clientId, String clientSecret) {
52+
public KeyVaultLoadStoreParameter(String uri, String aadAuthenticationUrl,
53+
String tenantId, String clientId, String clientSecret) {
4754
this.uri = uri;
55+
this.aadAuthenticationUrl = aadAuthenticationUrl;
4856
this.tenantId = tenantId;
4957
this.clientId = clientId;
5058
this.clientSecret = clientSecret;
51-
this.userAssignedIdentity = null;
59+
this.managedIdentity = null;
5260
}
5361

5462
/**
5563
* Constructor.
5664
*
5765
* @param uri the Azure Key Vault URI.
58-
* @param userAssignedIdentity the user-assigned identity.
66+
* @param managedIdentity the managed identity.
5967
*/
60-
public KeyVaultLoadStoreParameter(String uri, String userAssignedIdentity) {
68+
public KeyVaultLoadStoreParameter(String uri, String managedIdentity) {
6169
this.uri = uri;
70+
this.aadAuthenticationUrl = null;
6271
this.tenantId = null;
6372
this.clientId = null;
6473
this.clientSecret = null;
65-
this.userAssignedIdentity = userAssignedIdentity;
74+
this.managedIdentity = managedIdentity;
6675
}
6776

6877
/**
@@ -72,10 +81,11 @@ public KeyVaultLoadStoreParameter(String uri, String userAssignedIdentity) {
7281
*/
7382
public KeyVaultLoadStoreParameter(String uri) {
7483
this.uri = uri;
84+
this.aadAuthenticationUrl = null;
7585
this.tenantId = null;
7686
this.clientId = null;
7787
this.clientSecret = null;
78-
this.userAssignedIdentity = null;
88+
this.managedIdentity = null;
7989
}
8090

8191
/**
@@ -88,6 +98,15 @@ public KeyStore.ProtectionParameter getProtectionParameter() {
8898
return null;
8999
}
90100

101+
/**
102+
* Get the Azure AD authentication URL.
103+
*
104+
* @return the Azure AD authentication URL.
105+
*/
106+
public String getAadAuthenticationUrl() {
107+
return aadAuthenticationUrl;
108+
}
109+
91110
/**
92111
* Get the client id.
93112
*
@@ -106,6 +125,15 @@ public String getClientSecret() {
106125
return clientSecret;
107126
}
108127

128+
/**
129+
* Get the managed identity.
130+
*
131+
* @return the managed identity.
132+
*/
133+
public String getManagedIdentity() {
134+
return managedIdentity;
135+
}
136+
109137
/**
110138
* Get the tenant id.
111139
*
@@ -123,13 +151,4 @@ public String getTenantId() {
123151
public String getUri() {
124152
return uri;
125153
}
126-
127-
/**
128-
* Get the user-assigned identity.
129-
*
130-
* @return the user-assign identity.
131-
*/
132-
public String getUserAssignedIdentity() {
133-
return userAssignedIdentity;
134-
}
135154
}

‎sdk/keyvault/azure-security-keyvault-jca/src/samples/java/sample/com/azure/security/keyvault/jca/ClientSSLSample.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ public void clientSSLSample() throws Exception {
3131
KeyStore ks = KeyStore.getInstance("AzureKeyVault");
3232
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
3333
System.getProperty("azure.keyvault.uri"),
34+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
3435
System.getProperty("azure.tenant.id"),
3536
System.getProperty("azure.client.id"),
3637
System.getProperty("azure.client.secret"));

‎sdk/keyvault/azure-security-keyvault-jca/src/samples/java/sample/com/azure/security/keyvault/jca/ServerSSLSample.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ public void serverSSLSample() throws Exception {
2121
KeyStore ks = KeyStore.getInstance("AzureKeyVault");
2222
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
2323
System.getProperty("azure.keyvault.uri"),
24+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
2425
System.getProperty("azure.tenant.id"),
2526
System.getProperty("azure.client.id"),
2627
System.getProperty("azure.client.secret"));

‎sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/AuthClientTest.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ public void testGetAuthorizationToken() throws Exception {
2727
AuthClient authClient = new AuthClient();
2828
String result = authClient.getAccessToken(
2929
"https://management.azure.com/",
30+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
3031
tenantId,
3132
clientId,
3233
URLEncoder.encode(clientSecret, "UTF-8")

‎sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/KeyVaultJcaProviderTest.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ public void testGetCertificate() throws Exception {
3636
KeyStore keystore = KeyStore.getInstance("AzureKeyVault");
3737
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
3838
System.getProperty("azure.keyvault.uri"),
39+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
3940
System.getProperty("azure.tenant.id"),
4041
System.getProperty("azure.client.id"),
4142
System.getProperty("azure.client.secret"));

‎sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/KeyVaultKeyStoreTest.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ public void testEngineGetCertificate() {
5151
KeyVaultKeyStore keystore = new KeyVaultKeyStore();
5252
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
5353
System.getProperty("azure.keyvault.uri"),
54+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
5455
System.getProperty("azure.tenant.id"),
5556
System.getProperty("azure.client.id"),
5657
System.getProperty("azure.client.secret"));
@@ -63,6 +64,7 @@ public void testEngineGetCertificateAlias() {
6364
KeyVaultKeyStore keystore = new KeyVaultKeyStore();
6465
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
6566
System.getProperty("azure.keyvault.uri"),
67+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
6668
System.getProperty("azure.tenant.id"),
6769
System.getProperty("azure.client.id"),
6870
System.getProperty("azure.client.secret"));
@@ -75,6 +77,7 @@ public void testEngineGetCertificateChain() {
7577
KeyVaultKeyStore keystore = new KeyVaultKeyStore();
7678
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
7779
System.getProperty("azure.keyvault.uri"),
80+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
7881
System.getProperty("azure.tenant.id"),
7982
System.getProperty("azure.client.id"),
8083
System.getProperty("azure.client.secret"));
@@ -87,6 +90,7 @@ public void testEngineIsCertificateEntry() {
8790
KeyVaultKeyStore keystore = new KeyVaultKeyStore();
8891
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
8992
System.getProperty("azure.keyvault.uri"),
93+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
9094
System.getProperty("azure.tenant.id"),
9195
System.getProperty("azure.client.id"),
9296
System.getProperty("azure.client.secret"));
@@ -99,6 +103,7 @@ public void testEngineSetCertificateEntry() {
99103
KeyVaultKeyStore keystore = new KeyVaultKeyStore();
100104
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
101105
System.getProperty("azure.keyvault.uri"),
106+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
102107
System.getProperty("azure.tenant.id"),
103108
System.getProperty("azure.client.id"),
104109
System.getProperty("azure.client.secret"));
@@ -123,6 +128,7 @@ public void testEngineGetKey() {
123128
KeyVaultKeyStore keystore = new KeyVaultKeyStore();
124129
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
125130
System.getProperty("azure.keyvault.uri"),
131+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
126132
System.getProperty("azure.tenant.id"),
127133
System.getProperty("azure.client.id"),
128134
System.getProperty("azure.client.secret"));
@@ -135,6 +141,7 @@ public void testEngineIsKeyEntry() {
135141
KeyVaultKeyStore keystore = new KeyVaultKeyStore();
136142
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
137143
System.getProperty("azure.keyvault.uri"),
144+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
138145
System.getProperty("azure.tenant.id"),
139146
System.getProperty("azure.client.id"),
140147
System.getProperty("azure.client.secret"));
@@ -159,6 +166,7 @@ public void testEngineAliases() {
159166
KeyVaultKeyStore keystore = new KeyVaultKeyStore();
160167
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
161168
System.getProperty("azure.keyvault.uri"),
169+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
162170
System.getProperty("azure.tenant.id"),
163171
System.getProperty("azure.client.id"),
164172
System.getProperty("azure.client.secret"));
@@ -171,6 +179,7 @@ public void testEngineContainsAlias() {
171179
KeyVaultKeyStore keystore = new KeyVaultKeyStore();
172180
KeyVaultLoadStoreParameter parameter = new KeyVaultLoadStoreParameter(
173181
System.getProperty("azure.keyvault.uri"),
182+
System.getProperty("azure.keyvault.aadAuthenticationUrl"),
174183
System.getProperty("azure.tenant.id"),
175184
System.getProperty("azure.client.id"),
176185
System.getProperty("azure.client.secret"));

0 commit comments

Comments
 (0)