|
|
|
@ -3,7 +3,7 @@ title: Azure Identity shared library for Java
|
|
|
|
|
keywords: Azure, java, SDK, API, azure-identity, identity
|
|
|
|
|
author: maggiepint
|
|
|
|
|
ms.author: magpint
|
|
|
|
|
ms.date: 07/10/2020
|
|
|
|
|
ms.date: 07/24/2020
|
|
|
|
|
ms.topic: article
|
|
|
|
|
ms.prod: azure
|
|
|
|
|
ms.technology: azure
|
|
|
|
@ -11,7 +11,7 @@ ms.devlang: java
|
|
|
|
|
ms.service: identity
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# Azure Identity shared library for Java - Version 1.1.0-beta.6
|
|
|
|
|
# Azure Identity shared library for Java - Version 1.1.0-beta.7
|
|
|
|
|
|
|
|
|
|
The Azure Identity library provides Azure Active Directory token authentication support across the Azure SDK. It provides a set of TokenCredential implementations which can be used to construct Azure SDK clients which support AAD token authentication.
|
|
|
|
|
|
|
|
|
@ -25,32 +25,8 @@ The Azure Identity library provides Azure Active Directory token authentication
|
|
|
|
|
|
|
|
|
|
[Source code][source] | [API reference documentation][javadoc] | [Azure Active Directory documentation][aad_doc]
|
|
|
|
|
|
|
|
|
|
## Table of contents
|
|
|
|
|
- [Getting started](#getting-started)
|
|
|
|
|
- [Adding the package to your project](#adding-the-package-to-your-project)
|
|
|
|
|
- [Prerequisites](#prerequisites)
|
|
|
|
|
- [Creating a Service Principal with the Azure CLI](#creating-a-service-principal-with-the-azure-cli)
|
|
|
|
|
- [Enable applications for device code flow](#enable-applications-for-device-code-flow)
|
|
|
|
|
- [Enable applications for interactive browser oauth 2 flow](#enable-applications-for-interactive-browser-oauth-2-flow)
|
|
|
|
|
- [Enable applications for oauth 2 auth code flow](#enable-applications-for-oauth-2-auth-code-flow)
|
|
|
|
|
- [Enable applications for shared token cache credential](#enable-applications-for-shared-token-cache-credential)
|
|
|
|
|
- [Key concepts](#key-concepts)
|
|
|
|
|
- [Credentials](#credentials)
|
|
|
|
|
- [DefaultAzureCredential](#defaultazurecredential)
|
|
|
|
|
- [Environment variables](#environment-variables)
|
|
|
|
|
- [Examples](#examples)
|
|
|
|
|
- [Authenticating with `DefaultAzureCredential`](#authenticating-with-defaultazurecredential)
|
|
|
|
|
- [Authenticating a service principal with a client secret](#authenticating-a-service-principal-with-a-client-secret)
|
|
|
|
|
- [Authenticating a user account with device code flow](#authenticating-a-user-account-with-device-code-flow)
|
|
|
|
|
- [Authenticating a user account with username and password](#authenticating-a-user-account-with-username-and-password)
|
|
|
|
|
- [Authenticating a user account with auth code flow](#authenticating-a-user-account-with-auth-code-flow)
|
|
|
|
|
- [Chaining credentials](#chaining-credentials)
|
|
|
|
|
- [Troubleshooting](#troubleshooting)
|
|
|
|
|
- [Next steps](#next-steps)
|
|
|
|
|
- [Contributing](#contributing)
|
|
|
|
|
|
|
|
|
|
## Getting started
|
|
|
|
|
### Adding the package to your project
|
|
|
|
|
### Include the package
|
|
|
|
|
|
|
|
|
|
Maven dependency for Azure Secret Client library. Add it to your project's pom file.
|
|
|
|
|
|
|
|
|
@ -59,7 +35,7 @@ Maven dependency for Azure Secret Client library. Add it to your project's pom f
|
|
|
|
|
<dependency>
|
|
|
|
|
<groupId>com.azure</groupId>
|
|
|
|
|
<artifactId>azure-identity</artifactId>
|
|
|
|
|
<version>1.0.7</version>
|
|
|
|
|
<version>1.0.9</version>
|
|
|
|
|
</dependency>
|
|
|
|
|
```
|
|
|
|
|
[//]: # ({x-version-update-end})
|
|
|
|
@ -95,11 +71,11 @@ Use the [Azure CLI][azure_cli] snippet below to create/get client secret credent
|
|
|
|
|
#### Enable applications for device code flow
|
|
|
|
|
In order to authenticate a user through device code flow, you need to go to Azure Active Directory on Azure Portal and find you app registration and enable the following 2 configurations:
|
|
|
|
|
|
|
|
|
|
![device code enable](https://github.com/Azure/azure-sdk-for-java/raw/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/identity/azure-identity/images/devicecode-enable.png)
|
|
|
|
|
![device code enable](https://github.com/Azure/azure-sdk-for-java/raw/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/identity/azure-identity/images/devicecode-enable.png)
|
|
|
|
|
|
|
|
|
|
This will let the application authenticate, but the application still doesn't have permission to log you into Active Directory, or access resources on your behalf. Open API Permissions, and enable Microsoft Graph, and the resources you want to access, e.g., Azure Service Management, Key Vault, etc:
|
|
|
|
|
|
|
|
|
|
![device code permissions](https://github.com/Azure/azure-sdk-for-java/raw/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/identity/azure-identity/images/devicecode-permissions.png)
|
|
|
|
|
![device code permissions](https://github.com/Azure/azure-sdk-for-java/raw/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/identity/azure-identity/images/devicecode-permissions.png)
|
|
|
|
|
|
|
|
|
|
Note that you also need to be the admin of your tenant to grant consent to your application when you login for the first time. Also note after 2018 your Active Directory may require your application to be multi-tenant. Select "Accounts in any organizational directory" under Authentication panel (where you enabled Device Code) to make your application a multi-tenant app.
|
|
|
|
|
|
|
|
|
@ -108,7 +84,7 @@ You need to register an application in Azure Active Directory with permissions t
|
|
|
|
|
|
|
|
|
|
You may notice in `InteractiveBrowserCredentialBuilder`, a port number is required, and you need to add the redirect URL on this page too:
|
|
|
|
|
|
|
|
|
|
![interactive redirect uri](https://github.com/Azure/azure-sdk-for-java/raw/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/identity/azure-identity/images/interactive-redirecturi.png)
|
|
|
|
|
![interactive redirect uri](https://github.com/Azure/azure-sdk-for-java/raw/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/identity/azure-identity/images/interactive-redirecturi.png)
|
|
|
|
|
|
|
|
|
|
In this case, the port number is 8765.
|
|
|
|
|
|
|
|
|
@ -120,7 +96,7 @@ You will need to have Visual Studio 2019 installed. Login to Visual Studio with
|
|
|
|
|
|
|
|
|
|
Open your Visual Studio account settings and you can see the list of accounts with cached tokens in the red rectangle below. Note the Personalization Account is not related to this token cache. You can delete all info and tokens of this account in the token cache by removing the account here and closing the Visual Studio window.
|
|
|
|
|
|
|
|
|
|
![vs2019 account settings](https://github.com/Azure/azure-sdk-for-java/raw/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/identity/azure-identity/images/vs2019-account-settings.png)
|
|
|
|
|
![vs2019 account settings](https://github.com/Azure/azure-sdk-for-java/raw/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/identity/azure-identity/images/vs2019-account-settings.png)
|
|
|
|
|
|
|
|
|
|
If you have multiple accounts listed here, you must specify the `AZURE_USERNAME` environment variable to the email of the account you'd like to use for all the authentications.
|
|
|
|
|
|
|
|
|
@ -171,8 +147,16 @@ principal authentication with these environment variables:
|
|
|
|
|
|
|
|
|
|
## Examples
|
|
|
|
|
|
|
|
|
|
### Table of contents
|
|
|
|
|
- [Authenticating with `DefaultAzureCredential`](#authenticating-with-defaultazurecredential)
|
|
|
|
|
- [Authenticating a service principal with a client secret](#authenticating-a-service-principal-with-a-client-secret)
|
|
|
|
|
- [Authenticating a user account with device code flow](#authenticating-a-user-account-with-device-code-flow)
|
|
|
|
|
- [Authenticating a user account with username and password](#authenticating-a-user-account-with-username-and-password)
|
|
|
|
|
- [Authenticating a user account with auth code flow](#authenticating-a-user-account-with-auth-code-flow)
|
|
|
|
|
- [Chaining credentials](#chaining-credentials)
|
|
|
|
|
|
|
|
|
|
### Authenticating with `DefaultAzureCredential`
|
|
|
|
|
This example demonstrates authenticating the `SecretClient` from the [azure-security-keyvault-secrets][secrets_client_library] client library using the `DefaultAzureCredential`. There's also [a compilable sample](https://github.com/Azure/azure-sdk-for-java/tree/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentitySamples.java) to create a Key Vault secret client you can copy-paste.
|
|
|
|
|
This example demonstrates authenticating the `SecretClient` from the [azure-security-keyvault-secrets][secrets_client_library] client library using the `DefaultAzureCredential`. There's also [a compilable sample](https://github.com/Azure/azure-sdk-for-java/tree/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentitySamples.java) to create a Key Vault secret client you can copy-paste.
|
|
|
|
|
|
|
|
|
|
<!-- embedme ../../keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentityReadmeSamples.java#L30-L42 -->
|
|
|
|
|
```java
|
|
|
|
@ -194,7 +178,7 @@ public void createDefaultAzureCredential() {
|
|
|
|
|
When executing this in a development machine you need to first [configure the environment](#environment-variables) setting the variables `AZURE_CLIENT_ID`, `AZURE_TENANT_ID` and `AZURE_CLIENT_SECRET` to the appropriate values for your service principal.
|
|
|
|
|
|
|
|
|
|
### Authenticating a service principal with a client secret
|
|
|
|
|
This example demonstrates authenticating the `KeyClient` from the [azure-security-keyvault-keys][keys_client_library] client library using the `ClientSecretCredential`. There's also [a compilable sample](https://github.com/Azure/azure-sdk-for-java/tree/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentitySamples.java) to create a Key Vault secret client you can copy-paste.
|
|
|
|
|
This example demonstrates authenticating the `KeyClient` from the [azure-security-keyvault-keys][keys_client_library] client library using the `ClientSecretCredential`. There's also [a compilable sample](https://github.com/Azure/azure-sdk-for-java/tree/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentitySamples.java) to create a Key Vault secret client you can copy-paste.
|
|
|
|
|
|
|
|
|
|
<!-- embedme ../../keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentityReadmeSamples.java#L44-L59 -->
|
|
|
|
|
```java
|
|
|
|
@ -217,7 +201,7 @@ public void createClientSecretCredential() {
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
### Authenticating a user account with device code flow
|
|
|
|
|
This example demonstrates authenticating the `KeyClient` from the [azure-security-keyvault-keys][keys_client_library] client library using the `DeviceCodeCredential` on an IoT device. There's also [a compilable sample](https://github.com/Azure/azure-sdk-for-java/tree/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentitySamples.java) to create a Key Vault secret client you can copy-paste.
|
|
|
|
|
This example demonstrates authenticating the `KeyClient` from the [azure-security-keyvault-keys][keys_client_library] client library using the `DeviceCodeCredential` on an IoT device. There's also [a compilable sample](https://github.com/Azure/azure-sdk-for-java/tree/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentitySamples.java) to create a Key Vault secret client you can copy-paste.
|
|
|
|
|
|
|
|
|
|
<!-- embedme ../../keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentityReadmeSamples.java#L61-L77 -->
|
|
|
|
|
```java
|
|
|
|
@ -241,7 +225,7 @@ public void createDeviceCodeCredential() {
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
### Authenticating a user account with username and password
|
|
|
|
|
This example demonstrates authenticating the `KeyClient` from the [azure-security-keyvault-keys][keys_client_library] client library using the `UsernamePasswordCredential`. The user must **not** have Multi-factor auth turned on. There's also [a compilable sample](https://github.com/Azure/azure-sdk-for-java/tree/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentitySamples.java) to create a Key Vault secret client you can copy-paste.
|
|
|
|
|
This example demonstrates authenticating the `KeyClient` from the [azure-security-keyvault-keys][keys_client_library] client library using the `UsernamePasswordCredential`. The user must **not** have Multi-factor auth turned on. There's also [a compilable sample](https://github.com/Azure/azure-sdk-for-java/tree/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentitySamples.java) to create a Key Vault secret client you can copy-paste.
|
|
|
|
|
|
|
|
|
|
<!-- embedme ../../keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentityReadmeSamples.java#L79-L94 -->
|
|
|
|
|
```java
|
|
|
|
@ -290,7 +274,7 @@ public void createAuthCodeCredential() {
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
### Chaining credentials
|
|
|
|
|
The `ChainedTokenCredential` class provides the ability to link together multiple credential instances to be tried sequentially when authenticating. The following example demonstrates creating a credential which will attempt to authenticate using managed identity, and fall back to certificate authentication if a managed identity is unavailable in the current environment. This example authenticates an `EventHubClient` from the [azure-eventhubs][eventhubs_client_library] client library using the `ChainedTokenCredential`. There's also [a compilable sample](https://github.com/Azure/azure-sdk-for-java/tree/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentitySamples.java) to create a Key Vault secret client you can copy-paste.
|
|
|
|
|
The `ChainedTokenCredential` class provides the ability to link together multiple credential instances to be tried sequentially when authenticating. The following example demonstrates creating a credential which will attempt to authenticate using managed identity, and fall back to certificate authentication if a managed identity is unavailable in the current environment. This example authenticates an `EventHubClient` from the [azure-eventhubs][eventhubs_client_library] client library using the `ChainedTokenCredential`. There's also [a compilable sample](https://github.com/Azure/azure-sdk-for-java/tree/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentitySamples.java) to create a Key Vault secret client you can copy-paste.
|
|
|
|
|
|
|
|
|
|
<!-- embedme ../../keyvault/azure-security-keyvault-secrets/src/samples/java/com/azure/security/keyvault/secrets/IdentityReadmeSamples.java#L112-L138 -->
|
|
|
|
|
```java
|
|
|
|
@ -344,13 +328,13 @@ This project has adopted the [Microsoft Open Source Code of Conduct][code_of_con
|
|
|
|
|
<!-- LINKS -->
|
|
|
|
|
[azure_cli]: https://docs.microsoft.com/cli/azure
|
|
|
|
|
[azure_sub]: https://azure.microsoft.com/free/
|
|
|
|
|
[source]: https://github.com/Azure/azure-sdk-for-java/tree/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/identity/azure-identity
|
|
|
|
|
[source]: https://github.com/Azure/azure-sdk-for-java/tree/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/identity/azure-identity
|
|
|
|
|
[aad_doc]: https://docs.microsoft.com/azure/active-directory/
|
|
|
|
|
[code_of_conduct]: https://opensource.microsoft.com/codeofconduct/
|
|
|
|
|
[keys_client_library]: https://github.com/Azure/azure-sdk-for-java/tree/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/keyvault/azure-security-keyvault-keys
|
|
|
|
|
[secrets_client_library]: https://github.com/Azure/azure-sdk-for-java/tree/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/keyvault/azure-security-keyvault-secrets
|
|
|
|
|
[eventhubs_client_library]: https://github.com/Azure/azure-sdk-for-java/tree/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/eventhubs/azure-messaging-eventhubs
|
|
|
|
|
[azure_core_library]: https://github.com/Azure/azure-sdk-for-java/tree/3f7a922640e0c9200cd62b6e7c9edd8fb0a4079b/sdk/core
|
|
|
|
|
[keys_client_library]: https://github.com/Azure/azure-sdk-for-java/tree/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/keyvault/azure-security-keyvault-keys
|
|
|
|
|
[secrets_client_library]: https://github.com/Azure/azure-sdk-for-java/tree/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/keyvault/azure-security-keyvault-secrets
|
|
|
|
|
[eventhubs_client_library]: https://github.com/Azure/azure-sdk-for-java/tree/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/eventhubs/azure-messaging-eventhubs
|
|
|
|
|
[azure_core_library]: https://github.com/Azure/azure-sdk-for-java/tree/bdf44fed128c50bec2d5201e91c5d1b3236301ab/sdk/core
|
|
|
|
|
[javadoc]: http://azure.github.io/azure-sdk-for-java
|
|
|
|
|
|
|
|
|
|
![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-java%2Fsdk%2Fidentity%2Fazure-identity%2FREADME.png)
|
|
|
|
|