protect-web-api: client and api by idg-sam · Pull Request #12 · Azure-Samples/ms-identity-java-servlet-webapp-authentication

idg-sam · 2021-06-28T18:42:41Z

No description provided.

derisen · 2021-06-28T19:17:32Z

+description: "This sample demonstrates a Java Spring web application calling a Java Spring web API that is secured using Azure AD"
+azureDeploy: <ENTER_FULLY_QUALIFIED_URL_TO_AN_AZURE_RESOURCE_MANAGER>
+extendedZipContent: <FILES_OR_FOLDERS_WITH_TWO_ABSOLUTE_PATHS_TO_INCLUDE_WITH_ZIP:PATH(NAME_IN_THE_REPO), TARGET(NAME_IN_THE_ZIP)>
+extensions: <ENTER_CONTENT_THAT_OTHER_TEAMS_CAN_USE_TO_IDENTIFY_SAMPLES>


Suggested change

extensions: <ENTER_CONTENT_THAT_OTHER_TEAMS_CAN_USE_TO_IDENTIFY_SAMPLES>

extensions: <ENTER_CONTENT_THAT_OTHER_TEAMS_CAN_USE_TO_IDENTIFY_SAMPLES>

Reminder to remove these

derisen · 2021-06-28T19:18:07Z

+- [More information](#more-information)
+- [Community Help and Support](#community-help-and-support)
+- [Contributing](#contributing)
+![Build badge](https://identitydivision.visualstudio.com/_apis/public/build/definitions/a7934fdd-dcde-4492-a406-7fad6ac00e17/<BuildNumber>/badge)


Suggested change

![Build badge](https://identitydivision.visualstudio.com/_apis/public/build/definitions/a7934fdd-dcde-4492-a406-7fad6ac00e17/<BuildNumber>/badge)

![Build badge](https://identitydivision.visualstudio.com/_apis/public/build/definitions/a7934fdd-dcde-4492-a406-7fad6ac00e17/<BuildNumber>/badge)

reminder to remove

kalyankrishna1 · 2021-06-28T19:35:13Z

@@ -0,0 +1,337 @@
+---


Update the home landing page of the whole tutorial

kalyankrishna1 · 2021-06-28T19:49:39Z

+   - Ensure that the **My APIs** tab is selected.
+   - In the list of APIs, select the API `java-servlet-resource-api`.
+   - In the **Delegated permissions** section, select the **Access 'java-servlet-resource-api'** in the list. Use the search box if necessary.
+   - Select the **Add permissions** button at the bottom.


Select

Add a link to use certificates MD file

kalyankrishna1 · 2021-06-28T19:53:05Z

+
+    ```Shell
+    cd project-directory
+    cd client-web-api


client-web-api

no folder by this name?

derisen · 2021-06-28T20:04:09Z

+- Upon successful completion of the sign-in flow, you should be redirected to the home page (`sign in status`) or `token details` page, depending on which button triggered your sign-in flow.
+- Note the context-sensitive button now says `Sign out` and displays your username to its left.
+- If you are on the home page, you'll see an option to click **ID Token Details**: click it to see some of the ID token's decoded claims.
+- You can also use the button on the top right to sign out. The status page will reflect this.


Would be good to add a step for "call api"

derisen · 2021-06-28T20:04:25Z

+
+   1. Find the resulting `.war` file in `./resource-api/target/msal4j-servlet-api.war` and deploy it to Tomcat or any other J2EE container solution. To deploy to Tomcat, copy this `.war` file to the `/webapps/` directory in your Tomcat installation directory and start the Tomcat server.
+1. Ensure that the context path that the app is served on is `/msal4j-servlet-client` (or change the `app.homePage` value in your [authentication.properties](src/main/resources/authentication.properties) file and in the AAD app registration). If you change the properties file, you'll needs to repeat step 3 above (maven clean and package).
+1. Open your browser and navigate to `http://localhost:8080/msal4j-servlet-client/`


Getting error: Server returned HTTP response code: 403 for URL: http://localhost:8080/msal4j-servlet-api/api/date

kalyankrishna1 · 2021-06-28T20:05:39Z

+
+## About the code
+
+This sample contains two projects. The client uses **MSAL for Java (MSAL4J)** to sign a user in and obtain a token for your API. The client side app is similar to the call-graph sample in chapter 2. The API app processes the incoming request and verifies that it has a valid access token. It leverages Nimbusds library to process and verify the incoming token. Please see the `resource-api/src/main/java.../helpers/JwtVerifier.java` for how the JwtVerifier is set up, and `resource-api/src/main/java.../servlets/AzureAccessTokenFilter.java`


chapter 2

Provide link

kalyankrishna1 · 2021-06-28T20:06:41Z

+
+## About the code
+
+This sample contains two projects. The client uses **MSAL for Java (MSAL4J)** to sign a user in and obtain a token for your API. The client side app is similar to the call-graph sample in chapter 2. The API app processes the incoming request and verifies that it has a valid access token. It leverages Nimbusds library to process and verify the incoming token. Please see the `resource-api/src/main/java.../helpers/JwtVerifier.java` for how the JwtVerifier is set up, and `resource-api/src/main/java.../servlets/AzureAccessTokenFilter.java`


Nimbusds

link

kalyankrishna1 · 2021-06-28T20:10:10Z

+########################################################################################
+#For V1 tokens, uncomment the two values (authority and client ID) in the section below:
+
+aad.clientId=api://Enter_Your_Client_ID_Here


clientId

this is not client id, but AppID URI

kalyankrishna1 · 2021-06-28T20:12:06Z

+    <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">
+    <link rel="stylesheet" href="./static/style.css">
+    <link rel="icon" type="image/x-icon" href="./static/favicon.ico">
+    <title>Authentication: Use MSAL Java to sign in users in your Azure Active Directory tenant</title>


Authentication: Use MSAL Java to sign in users in your Azure Active Directory tenant

chnage this

kalyankrishna1 · 2021-06-28T20:13:28Z

+aad.clientId=api://Enter_Your_Client_ID_Here
+aad.authority=https://sts.windows.net/Enter_Your_Tenant_ID_Here/
+
+


derisen

LGTM! Left a bunch of comments for the README

kalyankrishna1 · 2021-06-28T20:24:57Z

+ * routes
+ */
+@WebFilter(filterName = "AzureAccessTokenFilter", urlPatterns = "/*")
+public class AzureAccessTokenFilter implements Filter {


AzureAccessTokenFilter

nit:change to AzureADAccessTokenFilter

kalyankrishna1 · 2021-06-28T20:30:15Z

+            // make an instance of the verifier (found in helpers.JwtVerifier)
+            // use AUTHORITY value from config for issuer.
+            // use CLIENT_ID value from config for audience.
+            // use SCOPES value from config for scopes.


heavil;y comment all that will be validated

kalyankrishna1 · 2021-06-28T20:30:58Z

+
+/**
+ * This class defines the endpoint for showing the graph /me endpoint
+ * This is here simply to demonstrate the graph call.


sangonzal

Great progress

sangonzal · 2021-07-01T19:52:58Z

@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>


What are we using this file for?

sangonzal · 2021-07-01T19:54:21Z

+    @Override
+    protected void doGet(final HttpServletRequest req, final HttpServletResponse resp)
+            throws ServletException, IOException {
+        logger.log(Level.FINE, "Request has come with params {0}", req.getQueryString());


Reminder for removing this line log statement.

sangonzal · 2021-07-01T19:59:08Z

+         *                            format:'{group-id} /protected-route-1
+         *                            /protected-route-2 /protected-route-N'
+         */
+        public ProtectedRoutes(List<String> authRoutes, List<String> groupNameAndRoutes, List<String> roleNameAndRoutes,


Seems like groupNameAndRoutes and roleNameAndRoutes never get used?

sangonzal · 2021-07-01T20:13:27Z

+import java.io.InputStreamReader;
+import java.net.HttpURLConnection;
+
+


nit: extra line

sangonzal · 2021-07-01T20:24:31Z

+        }
+    }
+
+    private static class NetClient {


Can we use the Graph SDK here instead?

sangonzal · 2021-07-01T20:57:45Z

+    /**
+     * AAD has many aliases. We need to account for this when verifying 
+     * @return
+     */
+
+    private void issuerVerifier() {
+
+    }


sangonzal · 2021-07-01T20:58:39Z

+        // RSA keys sourced from the JWK set URL
+        return new JWSVerificationKeySelector<>(expectedJWSAlg, keySource);
+    }
+


extra space

sangonzal · 2021-07-01T21:01:46Z

+            // if the verification is successful, you'll receive a JWTClaimsSet
+            JWTClaimsSet claimsSet = verifier.getJWTClaimsSet(accessToken);
+            // put it into the request so the request handling servlet can make use of its claims as neeed.
+            req.setAttribute("accessToken", claimsSet);


nit: consider renaming this attribute to accessTokenClaims

sangonzal · 2021-07-01T21:11:45Z

+            String msg = String.format("An error occurred when validating the JWT signature: %s", e.getMessage());
+            logger.log(Level.WARNING, msg);
+            HttpServletResponse httpResponse = (HttpServletResponse) res;
+            PrintWriter out;
+            out = httpResponse.getWriter();
+            httpResponse.setStatus(403);
+            out.write(msg);
+            out.close();


Do you know what kind of information Spring/Identity Web return to the caller when JWT validation fails? I ask because we might not want to return any information about the JWT validation error to callers, as this could be a security vulnerability.

Also we can discuss this in person but I think 401 status code might be a bit more appropriate here. I see 401 as saying, "Unauthenticated" or "Could not validate your identity", while 403 is "Unauthorized" or "Validated your identity, but you don't have the permissions to access this specific resource"

sangonzal · 2021-07-01T21:21:01Z

+        PrintWriter out;
+        out = resp.getWriter();
+        resp.setContentType("text/html");
+        resp.setStatus(200);
+        out.write(dateAsJson());
+        out.close();


Suggested:

resp.setContentType("text/html"); resp.setStatus(200); PrintWriter out = resp.getWriter(); out.write(dateAsJson()); out.close();

idg-sam added 3 commits June 28, 2021 11:34

protect-web-api: client and api

e6fa38a

protect-web-api: update readme

a4c5a71

protect-web-api: update readme

602cea8

idg-sam requested review from derisen and kalyankrishna1 June 28, 2021 19:09

derisen reviewed Jun 28, 2021

View reviewed changes

kalyankrishna1 reviewed Jun 28, 2021

View reviewed changes

derisen reviewed Jun 28, 2021

View reviewed changes

Comment thread 3-Authorization-II/web-api/resource-api/src/main/resources/authentication.properties Outdated

derisen reviewed Jun 28, 2021

View reviewed changes

Comment thread 3-Authorization-II/web-api/resource-api/src/main/resources/authentication.properties Outdated

kalyankrishna1 reviewed Jun 28, 2021

View reviewed changes

derisen reviewed Jun 28, 2021

View reviewed changes

kalyankrishna1 reviewed Jun 28, 2021

View reviewed changes

derisen self-requested a review June 28, 2021 20:17

derisen approved these changes Jun 28, 2021

View reviewed changes

kalyankrishna1 reviewed Jun 28, 2021

View reviewed changes

idg-sam added 6 commits June 28, 2021 13:34

protect-web-api: rm superflous file

44f29f6

protect-web-api: fix issuer validation for v2

c1b297b

protect-web-api: update to remove trailing slashes

24e1750

protect-web-api: update configs

6997a5e

protect-web-api: update AT filter

b4cfe3c

protect-web-api: fix for proper v1+v2 token handling

91e61d5

idg-sam added 4 commits June 28, 2021 14:28

protect-web-api: update config file comments for clarity

c75ab4b

protect-web-api: remove superflous files

45f2f84

protect-web-api: update app creation scripts manual steps for clarity

1f793f0

protect-web-api: update app creation scripts manual steps for clarity

4433bb0

sangonzal reviewed Jul 1, 2021

View reviewed changes

	extensions: <ENTER_CONTENT_THAT_OTHER_TEAMS_CAN_USE_TO_IDENTIFY_SAMPLES>
	extensions: <ENTER_CONTENT_THAT_OTHER_TEAMS_CAN_USE_TO_IDENTIFY_SAMPLES>

	![Build badge](https://identitydivision.visualstudio.com/_apis/public/build/definitions/a7934fdd-dcde-4492-a406-7fad6ac00e17/<BuildNumber>/badge)
	![Build badge](https://identitydivision.visualstudio.com/_apis/public/build/definitions/a7934fdd-dcde-4492-a406-7fad6ac00e17/<BuildNumber>/badge)


		## About the code

		This sample contains two projects. The client uses MSAL for Java (MSAL4J) to sign a user in and obtain a token for your API. The client side app is similar to the call-graph sample in chapter 2. The API app processes the incoming request and verifies that it has a valid access token. It leverages Nimbusds library to process and verify the incoming token. Please see the `resource-api/src/main/java.../helpers/JwtVerifier.java` for how the JwtVerifier is set up, and `resource-api/src/main/java.../servlets/AzureAccessTokenFilter.java`

		aad.clientId=api://Enter_Your_Client_ID_Here
		aad.authority=https://sts.windows.net/Enter_Your_Tenant_ID_Here/

		import java.io.InputStreamReader;
		import java.net.HttpURLConnection;

Uh oh!

Conversation

idg-sam commented Jun 28, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

derisen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sangonzal left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants