com.microsoft.azure.keyvault.authentication

Class KeyVaultCredentials

java.lang.Object

com.microsoft.windowsazure.credentials.CloudCredentials

com.microsoft.azure.keyvault.authentication.KeyVaultCredentials

All Implemented Interfaces:

BearerCredentialsSupport

public abstract class KeyVaultCredentials
extends CloudCredentials
implements BearerCredentialsSupport

An implementation of CloudCredentials that supports automatic bearer token refresh.

Constructor Summary

Constructors

Constructor and Description
KeyVaultCredentials()

Method Summary

Modifier and Type	Method and Description
<T> void	applyConfig(String profile, Map<String,Object> properties)
org.apache.http.Header	authenticate(ServiceRequestContext request, BearerAuthentication authentication) Authenticates a request by answering a challenge.
abstract org.apache.http.Header	doAuthenticate(ServiceRequestContext request, Map<String,String> challenge) Answers a server challenge with a token header.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

KeyVaultCredentials

public KeyVaultCredentials()

Method Detail

applyConfig

public <T> void applyConfig(String profile,
                            Map<String,Object> properties)

Specified by:

applyConfig in class CloudCredentials

authenticate

public org.apache.http.Header authenticate(ServiceRequestContext request,
                                           BearerAuthentication authentication)

Description copied from interface: BearerCredentialsSupport

Authenticates a request by answering a challenge.

Implementations typically call BearerAuthentication.getParameters() to identify the challenge, then obtain a token that satisfies the challenge, and finally return a authorization header object.

This method can return null, in which case the user will typically see a 401 Unauthorized error.

Specified by:

authenticate in interface BearerCredentialsSupport

doAuthenticate

public abstract org.apache.http.Header doAuthenticate(ServiceRequestContext request,
                                                      Map<String,String> challenge)

Answers a server challenge with a token header.

Implementations typically use ADAL to get a token, as performed in the sample below:

 @Override
 public Header doAuthenticate(ServiceRequestContext request, Map<String, String> challenge) {
     String authorization = challenge.get("authorization");
     String resource = challenge.get("resource");
     String clientId = ...; // client GUID as shown in Azure portal.
     String clientKey = ...; // client key as provided by Azure portal.
     AuthenticationResult token = getAccessTokenFromClientCredentials(authorization, resource, clientId, clientKey);
     return new BasicHeader("Authorization", token.getAccessTokenType() + " " + token.getAccessToken());
 }

 private static AuthenticationResult getAccessTokenFromClientCredentials(String authorization, String resource, String clientId, String clientKey) {
     AuthenticationContext context = null;
     AuthenticationResult result = null;
     ExecutorService service = null;
     try {
         service = Executors.newFixedThreadPool(1);
         context = new AuthenticationContext(authorization, false, service);
         ClientCredential credentials = new ClientCredential(clientId, clientKey);
         Future<AuthenticationResult> future = context.acquireToken(resource, credentials, null);
         result = future.get();
     } catch (Exception e) {
         throw new RuntimeException(e);
     } finally {
         service.shutdown();
     }

     if (result == null) {
         throw new RuntimeException("authentication result was null");
     }
     return result;
 }
 

Note: The client key must be securely stored. It's advised to use two client applications - one for development and other for production - managed by separate parties.