Using ADAL module results in OkHttpClient warning

[sec23206]

Please provide us with the following information:

This issue is for a: (mark with an x)

- [x] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Include the KeyVaultADALAuthenticator.java module in your project, and set the Azure client ID and secret as properties AZURE_CLIENT_ID and AZURE_CLIENT_SECRET respectively. Then use the code as follows:

KeyVaultClient kvClient = KeyVaultADALAuthenticator.getAuthenticatedClient(); SecretBundle secret = kvClient.getSecret(kvURI, secretName);

This seems to work as I'm able to extract the secret from Key Vault. However, I then start seeing this warning message on the console:

2019-09-05 13:24:12.904 WARN 78283 --- [ ConnectionPool] okhttp3.OkHttpClient : A connection to https://[Key Vault URI]/ was leaked. Did you forget to close a response body? To see where this was allocated, set the OkHttpClient logger level to FINE: Logger.getLogger(OkHttpClient.class.getName()).setLevel(Level.FINE);

Any log messages given by the failure

Just the warning message included above.

Expected/desired behavior

I presume the code is using OkHttpClient to perform the authentication to Key Vault, and that it should close the response body when finished.

OS and Version?

Windows 7, 8 or 10. Linux (which distribution). macOS (Yosemite? El Capitan? Sierra?)

macOS 10.14.6

Versions

java version "1.8.0_191"
Java(TM) SE Runtime Environment (build 1.8.0_191-b12)
Java HotSpot(TM) 64-Bit Server VM (build 25.191-b12, mixed mode)

Mention any other details that might be useful

After getting the secret, I've tried adding the following line to close any lingering connections, but that doesn't prevent the warning message:

kvClient.httpClient().connectionPool().evictAll();

---

Thanks! We'll be in touch soon.