{"id":7287,"date":"2016-12-06T15:21:58","date_gmt":"2016-12-06T14:21:58","guid":{"rendered":"https:\/\/blog.redbaronofazure.com\/?p=7287"},"modified":"2016-12-06T15:28:51","modified_gmt":"2016-12-06T14:28:51","slug":"authentication-in-azure-sdk-for-java","status":"publish","type":"post","link":"https:\/\/blog.redbaronofazure.com\/?p=7287","title":{"rendered":"Authentication in Azure SDK for Java"},"content":{"rendered":"

The 1.0.0-beta version of the Azure\u00a0SDK for java introduces a new model for authenticating that is called “file-based authentication”. Although being described as an experimental feature, it is a way to use a service principal account when managing ARM-based resources in Azure.<\/p>\n

Creating a Service Principal<\/strong><\/p>\n

The documentation for setting this up is tucked away in a file named AUTH.md<\/a> in github, but you have to know a little Azure AD in order to understand what is happening here. In step 5. you create the service principal via the Azure CLI command below<\/p>\n

azure config mode arm\r\nazure ad sp create --name spFawltytowers2 --password <pwd><\/pre>\n
This Service Principal shows up as an application in the Azure Portal which is a little confusing since it is listed amongst real application entries. The guid of the the Application ID is something you need to copy, because you will use this as the client id in your Java program configuration.<\/p>\n
\"azurejdk-auth-01\"<\/a><\/p>\n
Even though you did provide a password, you need to create a key in the portal. The value can be anything you like but make sure you don’t loose it, because the portal will not display its value once you have saved it.<\/p>\n
\"azurejdk-auth-02\"<\/a><\/p>\n
Creating the configuration file<\/strong><\/p>\n
The configuration file holds the client + key to identify the service principal but it should also contain information about the\u00a0Azure subscription that we like to use and the Azure AD that can authenticate us. The Azure CLI command “azure account show” can display your current subscription and AAD tenant. The ID field is the subscription ID and you also need to copy the Tenant ID, which is the guid for the Azure AD that we will authenticate with.<\/p>\n
\"azurejdk-auth-03\"<\/a><\/p>\n
These four values – client, key, subscription id and tenant id – is something you put in a text file you store with your Java application. It has the following format:<\/p>\n
\"azurejdk-auth-04\"<\/a><\/p>\n
The URLs is something you likely just can steal with pride from somewhere, but if you really like to get the values for real, you can get them with the Azure CLI command “azure account env show AzureCloud”, where the value “AzureCloud” comes\u00a0of the output in the previous CLI command.<\/p>\n
Granting access to the Service Principal<\/strong><\/p>\n
If you ran your Java program now, it would be able to authenticate against Azure AD using the Service Principal but it would not be able to do anything in the Azure Subscription because we haven’t granted it any access rights yet. Depending on how you are going to use this service principal, you may add it to a resource group, etc, but if you are building something that should be able to manage all resources in the subscription, you need to add it as a Contributor to the entire subscription.<\/p>\n
\"azurejdk-auth-05\"<\/a><\/p>\n
Go to Subscriptions (Yellow key) > Access >Control (IAM) and add the service principal as a Contributor.<\/p>\n
Testing that it works<\/strong><\/p>\n
To test that it works you can create a tiny Java application that uses the Azure SDK for Java. The 1.0.0-beta version of the SDK builds with Maven, so create a Maven project and enter the dependancy in the pom.xml file<\/p>\n
<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<project xmlns=\"http:\/\/maven.apache.org\/POM\/4.0.0\"\r\n         xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"\r\n         xsi:schemaLocation=\"http:\/\/maven.apache.org\/POM\/4.0.0 http:\/\/maven.apache.org\/xsd\/maven-4.0.0.xsd\">\r\n    <modelVersion>4.0.0<\/modelVersion>\r\n\r\n    <groupId>com.fawltytowers2<\/groupId>\r\n    <artifactId>aztest1<\/artifactId>\r\n    <version>1.0-SNAPSHOT<\/version>\r\n\r\n    <dependencies>\r\n        <dependency>\r\n            <groupId>com.microsoft.azure<\/groupId>\r\n            <artifactId>azure<\/artifactId>\r\n            <version>1.0.0-beta3<\/version>\r\n        <\/dependency>\r\n    <\/dependencies>\r\n\r\n<\/project><\/pre>\n
Then pass the configuration file to the Azure.authenticate method and you will be able to access resources in your subscription. The below little sample program just lists all resource groups (which in this test was just a single one)<\/p>\n
\"azurejdk-auth-06\"<\/a><\/p>\n
References<\/strong><\/p>\n
Azure SDK for Java
\nhttps:\/\/github.com\/Azure\/azure-sdk-for-java<\/a><\/p>\n
Documentation for creating the Service Principal
\nhttps:\/\/github.com\/Azure\/azure-sdk-for-java\/blob\/master\/AUTH.md<\/a><\/p>\n
Sample Java program for testing
\nhttps:\/\/github.com\/Azure-Samples\/resources-java-manage-resource-group<\/a><\/p>\n
 <\/p>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
The 1.0.0-beta version of the Azure\u00a0SDK for java introduces a new model for authenticating that is called “file-based authentication”. Although being described as an experimental feature, it is a way to use a service principal account when managing ARM-based resources in Azure. Creating a Service Principal The documentation for setting this up is tucked away […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[392,151],"tags":[393,409],"_links":{"self":[{"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/posts\/7287"}],"collection":[{"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7287"}],"version-history":[{"count":3,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/posts\/7287\/revisions"}],"predecessor-version":[{"id":7296,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/posts\/7287\/revisions\/7296"}],"wp:attachment":[{"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}