[JAVA] Sign in to a Spring Boot web application on the Microsoft ID platform


Microsoft's official documentation is confusing, and library updates aren't keeping up, making it difficult to sign in with an Azure AD account [^ 1] from the latest Spring Boot. Here's a summary of what's happening to implement sign-in at the moment.

--Spring Boot Starter for Azure AD cannot be started as it is --Microsoft documents are also old, as updates are generally not keeping up. --For authentication only, it is possible only with OAuth2 of Spring Security --There are almost no Japanese materials --If you want to access each function through Microsoft Graph after authentication, use Microsoft Graph SDK for Java [^ 2]


[Azure AD Spring Boot Starter client library for Java (2.3.5)](https://github.com/Azure/azure-sdk-for-java/tree/407b4e0bffbb75b461c0512e669a6d43376fa7ab/sdk/spring/azure-spring-boot-starter -active-directory)

I think the first thing to hit is this library [^ 3]. This is a project led by Microsoft. Since it uses the functions of the Oauth2 client of Spring Boot / Spring Security, there are fewer setting items and implementation ranges than other options. Documents about the integration between Azure AD and Spring are scattered in various places on Microsoft's site, but at the moment [Github documentation](https://github.com/Azure/azure-sdk-for-java/ See tree / 407b4e0bffbb75b461c0512e669a6d43376fa7ab / sdk / spring / azure-spring-boot-starter-active-directory). It should be the latest description. The main scenario covered in this article is Backend Authentication Flow (https://github.com/Azure/azure-sdk-for-java/tree/407b4e0bffbb75b461c0512e669a6d43376fa7ab/sdk/spring/azure-spring- boot-starter-active-directory # authorization-code-mode-usage).

We will proceed with the work based on this document, but ** Currently it does not work with the settings according to ReadMe → It was corrected based on the report, but please wait for it to be reflected in maven **.

I also found out the reason reported on GitHub, but due to the dependency of Spring Boot 2.3.5 The version of nimbus-jose-jwt on which AAD-Starter depends has been upgraded and cannot be started. This happens because since 8.10 of nimbus-jose-jwt, an argument to specify the refresh cycle has been added to the constructor of DefaultJWKSetCache. First of all, we will deal with this.

Override AADAuthenticationFilterAutoConfiguration settings to make it bootable

Fortunately, the cause of this bug is in the Bean definition of AutoConfig, so it is possible to ** resolve it at runtime **. (The source code for this issue was fixed while writing the article) It's not good to lower the nimbus-jose-jwt version here, so I'll fix it and use it. To use AAD-Starter, you basically inherit WebSecurityConfigurerAdapter and write Config, so overwrite the old Bean definition there.


/*Added comment part to ReadMe sample*/

@EnableGlobalMethodSecurity(prePostEnabled = true)
public class AADOAuth2LoginConfig extends WebSecurityConfigurerAdapter {

    private OAuth2UserService<OidcUserRequest, OidcUser> oidcUserService;

    //Inject configuration properties
    private AADAuthenticationProperties aadAuthProps;

    protected void configure(HttpSecurity http) throws Exception {

    //Bean definition that overrides the problem setting
    public JWKSetCache getJWKSetCache() {
        long lifespan = aadAuthenticationProperties.getJwkSetCacheLifespan();
        return new DefaultJWKSetCache(lifespan, lifespan, TimeUnit.MILLISECONDS);

This bean definition reproduces the same behavior as before the version upgrade, but it contains problems. Since the cache life and refresh cycle are the same, you may get irregular errors at run time [^ 4]. To solve this, you need to set the second argument of DefaultJWKSetCache to a number smaller than the first argument, and you need to create your own property or specify it in your code. Also, it seems that the no-argument constructor has a lifespan of 15 minutes and a refresh cycle of 5 minutes, so if there seems to be no problem with that cycle, you can choose to use the no-argument constructor.

Register the app with Arue

This basically works fine with the settings as documented.

It's important to note that the redirect URL must be the Spring Security default {baseURL} / login / oauth2 / code / azure. I feel like I could change it in the properties of Spring Security, but I didn't succeed. [^ 5]

And another important thing is ** access to the API given to the app **. This is a complete trap, but the content of the document ** requires Azure AD Graph permissions **, not MicroSoft Graph permissions. 許可するAPI.png

In the current Azure web screen, the display of Azure AD Graph is at the bottom, and even if you give the conspicuous MicroSoft Graph permission, you will worship AADSTS90008 no matter how hard you try. I made a mistake about this, but it took me a while to notice (because I suspected a bug in the code ...). After noticing this, I was able to successfully control permissions using departments and security groups.

During description → After logging in, use the Graph function to do various things

I've exhausted my efforts to avoid and fix problems in the library, so I'll put it on hold ...


By avoiding the problem of this library and investigating the access authority, the mechanism of cooperation between OAuth2 authentication in Spring Security and Azure AD (Microsoft ID platform) was well understood. The Azure AD Spring Boot Starter client library for Java seems to be significantly updated in the next version, but it seems to have a lot of problems at the moment.

If you find any problems in the library survey, you may want to report them.

[^ 1]: The range I touched on is limited to Azure AD single tenants only. [^ 2]: However, since the access point of this SDK is an old version (v1.0), you need to use beta when using v2.0. [^ 3]: Abbreviated as AAD-Starer below [^ 4]: The fix for nimbus-jose-jwt also seems to be due to this, and it was shared on GitHub that this fix is ad hoc. [^ 5]: There is a possibility of insufficient understanding and verification.

Reference material

Azure AD Spring Boot Starter client library for Java[^10] [^ 10]: Probably the newest Starter docs OAuth 2.0 Sample for Azure AD Spring Boot Starter client library for Java A Java web application using Spring security which signs in users with the Microsoft identity platform [Microsoft ID Platform](Azure AD) Java Web App (WAR file) -Settings- 【spring-projects/spring-security】OAuth 2.0 Migration Guide Spring Security Reference12.1. OAuth 2.0 Login

Recommended Posts

Sign in to a Spring Boot web application on the Microsoft ID platform
Minimal configuration to run Spring Boot application on Azure Web Apps
Java beginner tried to make a simple web application using Spring Boot
Automatically deploy a web application developed in Java using Jenkins [Spring Boot application]
Deploy the WEB application by Spring Boot to Tomcat server as WAR
How to add a classpath in Spring Boot
Deploy a Spring Boot application on Elastic Beanstalk
I tried to clone a web application full of bugs with Spring Boot
How to set environment variables in the properties file of Spring boot application
How to create a Spring Boot project in IntelliJ
Deploy the Spring Boot project to Tomcat on XAMPP
Spring Boot on Microsoft Azure
[Spring Boot] Web application creation
How to check the WEB application created in the PC development environment on your smartphone
A story that stumbled when deploying a web application created with Spring Boot to EC2
[Java] Deploy the Spring Boot application to Azure App Service
Deploy the application created by Spring Boot to Heroku (public) ②
Sample web application that handles multiple databases in Spring Boot 1.5
Deploy the application created by Spring Boot to Heroku (public) ①
I tried to implement a buggy web application in Kotlin
Spring Boot application development in Eclipse
Implement Spring Boot application in Gradle
Let's make a book management web application with Spring Boot part1
Get a proxy instance of the component itself in Spring Boot
Let's make a book management web application with Spring Boot part3
Let's make a book management web application with Spring Boot part2
What I did in the migration from Spring Boot 1.4 series to 2.0 series
What I did in the migration from Spring Boot 1.5 series to 2.0 series
[Spring Boot] Precautions when developing a web application with Spring Boot and placing war on an independent Tomcat server
Procedure to make the value of the property file visible in Spring Boot
Start web application development with Spring Boot
Volume of trying to create a Java Web application on Windows Server 2016
How to migrate a web application created in a local docker environment to AWS
Run WEB application with Spring Boot + Thymeleaf
How to get the ID of a user authenticated with Firebase in Swift
03. I sent a request from Spring Boot to the zip code search API
[Spring Boot] How to get properties dynamically from a string contained in a URL
Get the path defined in Controller class of Spring boot as a list
Learn while making a WEB server Introduction to WEB application development from the basics
From creating a Spring Boot project to running an application with VS Code
Run a Spring Boot project in VS Code
How to display a web page in Java
The story of raising Spring Boot 1.5 series to 2.1 series
Java tips-Create a Spring Boot project in Gradle
How to bind to property file in Spring Boot
[Java / PostgreSQL] Connect the WEB application to the database
Create a web api server with spring boot
[Spring Boot] How to refer to the property file
View the Gradle task in the Spring Boot project
The road to creating a Web service (Part 1)
I want to read the property file with a file name other than application.yml or application- [profile name] .yml with Spring Boot.
What I was addicted to when developing a Spring Boot application with VS Code
Until you create a Spring Boot project in Intellij and push it to Github
Leverage Spring AOP + CyclicBarrier to ensure optimistic lock testing conditions on the Spring Boot app
Specify the encoding of static resources in Spring Boot
[Introduction] Try to create a Ruby on Rails application
3. Create a database to access from the web module
How to write a unit test for Spring Boot 2
A memorandum of addiction to Spring Boot2 x Doma2
05. I tried to stub the source of Spring Boot
I tried to reduce the capacity of Spring Boot