Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Write sample about spring-security + Azure AD, authorize OAuth2 client by certificate #26418

Closed
Tracked by #25817
chenrujun opened this issue Jan 12, 2022 · 56 comments
Closed
Tracked by #25817

Write sample about spring-security + Azure AD, authorize OAuth2 client by certificate #26418

chenrujun opened this issue Jan 12, 2022 · 56 comments
Assignees
@chenrujun
Labels
azure-spring All azure-spring related issues azure-spring-aad Spring active directory related issues. azure-spring-samples Client This issue points to a problem in the data-plane of the library. feature-request This issue requires a new behavior in the product in order be resolved.
Milestone
Backlog

Comments

@chenrujun
Copy link

chenrujun commented Jan 12, 2022 •
edited
Loading

Context

Now all samples about spring-security + AAD are using client-id and client-secret. We need provide samples without client-secret, use certificate instead.

Refs: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow#request-an-access-token-with-a-certificate-credential

Related issue: #27029

Problem

Customers need this sample.

Solution

Write sample about spring-security + Azure AD, authorize OAuth2 client by certificate
@ghost ghost added the needs-triage Workflow: This is a new issue that needs to be triaged to the appropriate team. label Jan 12, 2022
@chenrujun chenrujun self-assigned this Jan 12, 2022
@chenrujun chenrujun added azure-spring All azure-spring related issues azure-spring-aad Spring active directory related issues. Client This issue points to a problem in the data-plane of the library. labels Jan 12, 2022
@ghost ghost removed the needs-triage Workflow: This is a new issue that needs to be triaged to the appropriate team. label Jan 12, 2022
@chenrujun chenrujun moved this to Todo in Spring Cloud Azure Jan 12, 2022
@chenrujun chenrujun added this to the Backlog milestone Jan 12, 2022
@chenrujun chenrujun mentioned this issue Jan 12, 2022
Closed
88 tasks
@mpenabad1961
Copy link

Hello chenrujun,

I am from UPS and we are working with MS (Mahesh Babu Thalla mthalla@microsoftsupport.com) on implementing Azure AD with Spring Boot, but with no client secret. I believe he chatted with you on this.
He mentioned you are working on a certificate based solution for Spring boot. Please let me know when the jar is ready to see if I can implement Azure AD. I currently use LDAP Spring Security and need to migrate to Azure AD, but UPS does not allow client-secret. Thanks.

@chenrujun chenrujun changed the title Write sample about spring-security + AAD, client authorize by certificate Write sample about spring-security + AAD, authorize OAuth2 client by certificate Jan 13, 2022
@chenrujun chenrujun changed the title Write sample about spring-security + AAD, authorize OAuth2 client by certificate Write sample about spring-security + Azure AD, authorize OAuth2 client by certificate Jan 13, 2022
@chenrujun
Copy link
Author

Hi, @mpenabad1961 . Thanks for reaching out.

I am from UPS and we are working with MS (Mahesh Babu Thalla mthalla@microsoftsupport.com) on implementing Azure AD with Spring Boot, but with no client secret. I believe he chatted with you on this.

Yes, I already discussed with him.

He mentioned you are working on a certificate based solution for Spring boot. Please let me know when the jar is ready to see if I can implement Azure AD

In this GitHub Issue, it will not release jar, it's target is to write sample to teach customer how to use spring-security + Azure AD.

I currently use LDAP Spring Security and need to migrate to Azure AD, but UPS does not allow client-secret.

Oh, you are using LDAP, not OAuth2. Mahesh and I are discussing about OAuth 2.

I found 2 links:

  1. https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/auth-ldap
  2. https://spring.io/guides/gs/authenticating-ldap/

If your requirement is same to above 2 links. Here is 2 options:

  1. You can investigate above 2 links by yourself.
  2. Wait sample tracked in Write sample about spring-security + Azure AD, LDAP login #26456. Let's discuss that issue.

@chenrujun chenrujun mentioned this issue Jan 13, 2022
Closed
@mpenabad1961
Copy link

Thanks for responding. I meant to say I am currently using LDAP but I need to migrate to Azure AD. However, I need to use certificate-base , client-secret not allowed at UPS standard. When you have a sample code on how to use certificate without using secret please let me know. thanks. Mercedes

@chenrujun
Copy link
Author

@mpenabad1961

Got it.
Then you should still use this issue to track your requirement.
I'll @ you here when the sample is ready.

@chenrujun
Copy link
Author

Hi, @mpenabad1961.

I create a PR to write sample about using certificate instead of client-secret to authenticate: Azure-Samples/azure-spring-boot-samples#196. Please take a look.

And which version of Spring Boot are you (UPS) using?

@mpenabad1961
Copy link

mpenabad1961 commented Feb 28, 2022 via email

@chenrujun chenrujun mentioned this issue Mar 3, 2022
Merged
@mpenabad1961
Copy link

mpenabad1961 commented Mar 31, 2022 via email

@mpenabad1961
Copy link

mpenabad1961 commented Mar 31, 2022 via email

@chenrujun
Copy link
Author

Hi, @mpenabad1961

Please check this link:

https://github.com/Azure-Samples/azure-spring-boot-samples/blob/31b81ff524cf711d950d09e9250534949cd78f7e/aad/spring-security/docs/servlet/oauth2/login-authenticate-using-private-key-jwt.md

@stliu stliu added feature-request This issue requires a new behavior in the product in order be resolved. azure-spring-samples labels Apr 3, 2022
@mpenabad1961
Copy link

mpenabad1961 commented Apr 14, 2022 via email

@chenrujun
Copy link
Author

@mpenabad1961

  1. Could you please try spring-cloud-azure_v4.0.0 branch? Here is the link to spring-cloud-azure_v4.0.0 branch branch: https://github.com/Azure-Samples/azure-spring-boot-samples/blob/spring-cloud-azure_v4.0.0/aad/spring-security/docs/servlet/oauth2/login-authenticate-using-private-key-jwt.md

  2. What type of filename errors did you faced? Could you please share more information?

@mpenabad1961
Copy link

mpenabad1961 commented Apr 15, 2022 via email

@mpenabad1961
Copy link

mpenabad1961 commented Apr 18, 2022 via email

@chenrujun
Copy link
Author

@mpenabad1961
Please try these commands:

git clone git@github.com:Azure-Samples/azure-spring-boot-samples.git
cd azure-spring-boot-samples/
mvn clean install -DskipTests

There is no error in my side.
If there are some errors in your side, please share related log or screenshot.

@chenrujun
Copy link
Author

@mpenabad1961

Can I just work on login-authenticate-using-private-key-jwt project folder?

Please try this:

git clone git@github.com:Azure-Samples/azure-spring-boot-samples.git
cd azure-spring-boot-samples/
mvn clean install -f aad/spring-security/servlet/oauth2/login-authenticate-using-private-key-jwt/

@mpenabad1961
Copy link

mpenabad1961 commented May 7, 2022 via email

@chenrujun
Copy link
Author

@mpenabad1961

Mvn install did not work.

Could you please share the log?

@mpenabad1961
Copy link

mpenabad1961 commented May 17, 2022 via email

@chenrujun
Copy link
Author

@mpenabad1961

The problem was we have SSO and I had to log out to see the Dialog login box.

You can use InPrivate windows to avoid this problem.

Refs:

  1. https://support.microsoft.com/en-us/microsoft-edge/browse-inprivate-in-microsoft-edge-cd2c9a48-0bc4-b98e-5e46-ac40c84e27e2
  2. https://support.google.com/chrome/answer/95464?hl=en&co=GENIE.Platform%3DDesktop

@mpenabad1961
Copy link

mpenabad1961 commented May 18, 2022 via email

@chenrujun
Copy link
Author

@mpenabad1961
I mean if you use InPrivate windows, you do not need to logout.

@moarychan
Copy link
Member

#29137

@mpenabad1961
Copy link

mpenabad1961 commented Jul 12, 2022 via email

@chenrujun
Copy link
Author

@mpenabad1961

After I do the oauthlogin()

How did you do that?
Could you please give more information that can help me to reproduce the problem?
For example:

  1. Steps I did.
  2. Error I faced.
  3. Error log.
  4. etc..

@mpenabad1961
Copy link

mpenabad1961 commented Jul 13, 2022 via email

@chenrujun
Copy link
Author

@mpenabad1961

I can't see your log.

Are you attach the log by email attachment?
I left current comment by this GitHub page: #26418

In logs, line # 2616 this is called,

I can't see the log. So, I don't know what the content about # 2616.

@mpenabad1961
Copy link

mpenabad1961 commented Jul 14, 2022 via email

@chenrujun
Copy link
Author

Hi, @mpenabad1961

I think now I can see 2 log files:

  1. One log file has 361 lines.
  2. Another log file has 378 lines.

But I can't understand the problem. Seems some information lost:
image

Here are some suggestions:

  1. Tell me your email address. I think we can discuss by a Teams meeting. The meeting will after 2022-08-08. Because I'll have holiday from next week.

  2. Send email to SpringIntegSupport@microsoft.com, give a clear description about the problem. Or create a sample to reproduce the problem.

@mpenabad1961
Copy link

mpenabad1961 commented Jul 21, 2022 via email

@chenrujun
Copy link
Author

Hi, @mpenabad1961

Sorry, I can't understand the problem clearly.
Could you please give me your email address? Let me book a meeting. Let's discuss in the meeting.

And my time zone is UTC+8. What's your time zone?

@mpenabad1961
Copy link

mpenabad1961 commented Aug 12, 2022 via email

@NidaNajam
Copy link

I am getting the below exception ,However there is clientid provided in application.yml file .
"AADSTS900144: The request body must contain the following parameter: 'client_id'.".
Any idea what can be reason or how to solve this issue?

@chenrujun
Copy link
Author

@mpenabad1961

I can't see the email address.
image

Please send email to me: rujche@microsoft.com

@chenrujun
Copy link
Author

Hi, @NidaNajam

I can't reproduce the problem. Could you please provide a project in GitHub to reproduce the problem?

@mpenabad1961
Copy link

mpenabad1961 commented Oct 11, 2022 via email

@mpenabad1961
Copy link

mpenabad1961 commented Oct 11, 2022 via email

@chenrujun
Copy link
Author

@mpenabad1961
Now I'm not sure whether firewall similar to proxy.

Now I'm developing a feature that make all http request send to Azure AD / Graph endpoint can send to proxy.

Refs: #31347

Maybe after this feature finished, it can solve the problem of firewall, too.

@mpenabad1961
Copy link

mpenabad1961 commented Oct 21, 2022 via email

@chenrujun
Copy link
Author

Hi, @mpenabad1961

It's done in version 4.4.1.

Please refer to: https://microsoft.github.io/spring-cloud-azure/4.4.1/reference/html/index.html#connecting-to-azure-ad-via-proxy

@stliu
Copy link
Member

stliu commented Dec 10, 2022

@chenrujun what's the status of this one?

@chenrujun
Copy link
Author

  1. spring-security + client-certificate is provided here: https://github.com/Azure-Samples/azure-spring-boot-samples/tree/main/aad/spring-security/servlet/oauth2/login-authenticate-using-private-key-jwt
  2. spring-cloud-azure-starter-active-directory + client-secret is not provided yet.

I think we can close this issue now. We can provide the second sample when there is customer ask.

Repository owner moved this from Todo to Done in Spring Cloud Azure Dec 12, 2022
@github-actions github-actions bot locked and limited conversation to collaborators Apr 11, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@chenrujun chenrujun

Labels
azure-spring All azure-spring related issues azure-spring-aad Spring active directory related issues. azure-spring-samples Client This issue points to a problem in the data-plane of the library. feature-request This issue requires a new behavior in the product in order be resolved.
Projects
Spring Cloud Azure
Archived in project
Milestone
Backlog
Development

No branches or pull requests
5 participants
@stliu @NidaNajam @chenrujun @moarychan @mpenabad1961