com.microsoft.aad.msal4j

Class ConfidentialClientApplication

java.lang.Object

com.microsoft.aad.msal4j.AbstractApplicationBase

com.microsoft.aad.msal4j.AbstractClientApplicationBase

com.microsoft.aad.msal4j.ConfidentialClientApplication

All Implemented Interfaces:

IConfidentialClientApplication

public class ConfidentialClientApplication
extends AbstractClientApplicationBase
implements IConfidentialClientApplication

Class to be used to acquire tokens for confidential client applications (Web Apps, Web APIs, and daemon applications). For details see IConfidentialClientApplication

Conditionally thread-safe

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	ConfidentialClientApplication.Builder

Field Summary

Fields

Modifier and Type	Field and Description
Function<AppTokenProviderParameters,CompletableFuture<TokenProviderResult>>	appTokenProvider AppTokenProvider creates a Credential from a function that provides access tokens.
static String	DEFAULT_AUTHORITY

Fields inherited from class com.microsoft.aad.msal4j.AbstractClientApplicationBase

azureRegion

Fields inherited from class com.microsoft.aad.msal4j.AbstractApplicationBase

authenticationAuthority, log, tokenCache

Method Summary

Modifier and Type	Method and Description
CompletableFuture<IAuthenticationResult>	acquireToken(AuthorizationCodeParameters parameters) Acquires security token from the authority using an authorization code previously received.
CompletableFuture<IAuthenticationResult>	acquireToken(ClientCredentialParameters parameters) Acquires tokens from the authority configured in the application, for the confidential client itself.
CompletableFuture<IAuthenticationResult>	acquireToken(OnBehalfOfParameters parameters) Acquires an access token for this application (usually a Web API) from the authority configured in the application, in order to access another downstream protected Web API on behalf of a user using the On-Behalf-Of flow.
CompletableFuture<IAuthenticationResult>	acquireToken(RefreshTokenParameters parameters) Acquires a security token from the authority using a refresh token previously received.
CompletableFuture<IAuthenticationResult>	acquireTokenSilently(SilentParameters parameters) Returns tokens from cache if present and not expired or acquires new tokens from the authority by using the refresh token present in cache.
String	authority() Gets the authority URL for this application.
static ConfidentialClientApplication.Builder	builder(String clientId, IClientCredential clientCredential) Creates instance of Builder of ConfidentialClientApplication
String	clientId() Gets the client ID (application ID) for this application.
String	correlationId() Gets the correlation ID used for tracing requests through the authentication system.
CompletableFuture<Set<IAccount>>	getAccounts() Returns accounts in the cache
URL	getAuthorizationRequestUrl(AuthorizationRequestUrlParameters parameters) Computes the URL of the authorization request letting the user sign-in and consent to the application.
IHttpClient	httpClient() Gets the HTTP client used by the application for all HTTP requests.
boolean	logPii() Gets whether personally identifiable information (PII) is included in log messages.
Proxy	proxy() Gets the proxy configuration used by the application for network communication.
CompletableFuture	removeAccount(IAccount account) Removes IAccount from the cache
boolean	sendX5c()
SSLSocketFactory	sslSocketFactory() Gets the SSL socket factory used by the application for secure network communication.
boolean	validateAuthority() Gets whether the authority URL should be validated against a list of known authorities.

Methods inherited from class com.microsoft.aad.msal4j.AbstractClientApplicationBase

aadAadInstanceDiscoveryResponse, acquireToken, acquireToken, acquireTokenSilently, applicationName, applicationVersion, authority, autoDetectRegion, azureRegion, clientCapabilities, clientId, getAccounts, getAuthorizationRequestUrl, instanceDiscovery, removeAccount, tokenCache, validateAuthority

Methods inherited from class com.microsoft.aad.msal4j.AbstractApplicationBase

connectTimeoutForDefaultHttpClient, correlationId, httpClient, logPii, proxy, readTimeoutForDefaultHttpClient, sslSocketFactory

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

appTokenProvider

public Function<AppTokenProviderParameters,CompletableFuture<TokenProviderResult>> appTokenProvider

AppTokenProvider creates a Credential from a function that provides access tokens. The function must be concurrency safe. This is intended only to allow the Azure SDK to cache MSI tokens. It isn't useful to applications in general because the token provider must implement all authentication logic.

DEFAULT_AUTHORITY

public static final String DEFAULT_AUTHORITY

See Also:

Constant Field Values

Method Detail

acquireToken

public CompletableFuture<IAuthenticationResult> acquireToken(ClientCredentialParameters parameters)

Description copied from interface: IConfidentialClientApplication

Acquires tokens from the authority configured in the application, for the confidential client itself. It will by default attempt to get tokens from the token cache. If no tokens are found, it falls back to acquiring them via client credentials from the STS

Specified by:

acquireToken in interface IConfidentialClientApplication

Parameters:

parameters - instance of ClientCredentialParameters

Returns:

CompletableFuture containing an IAuthenticationResult

acquireToken

public CompletableFuture<IAuthenticationResult> acquireToken(OnBehalfOfParameters parameters)

Description copied from interface: IConfidentialClientApplication

Acquires an access token for this application (usually a Web API) from the authority configured in the application, in order to access another downstream protected Web API on behalf of a user using the On-Behalf-Of flow. It will by default attempt to get tokens from the token cache. This confidential client application was itself called with an acces token which is provided in the UserAssertion field of OnBehalfOfParameters.

When serializing/deserializing the in-memory token cache to permanent storage, there should be a token cache per incoming access token, where the hash of the incoming access token can be used as the token cache key. Access tokens are usually only valid for a 1 hour period of time, and a new access token in the UserAssertion means there will be a new token cache and new token cache key. To avoid your permanent storage from being filled with expired token caches, an eviction policy should be set. For example, a token cache that is more than a couple of hours old can be deemed expired and therefore evicted from the serialized token cache.

Specified by:

acquireToken in interface IConfidentialClientApplication

Parameters:

parameters - instance of OnBehalfOfParameters

Returns:

CompletableFuture containing an IAuthenticationResult

builder

public static ConfidentialClientApplication.Builder builder(String clientId,
                                                            IClientCredential clientCredential)

Creates instance of Builder of ConfidentialClientApplication

Parameters:

clientId - Client ID (Application ID) of the application as registered in the application registration portal (portal.azure.com)

clientCredential - The client credential to use for token acquisition.

Returns:

instance of Builder of ConfidentialClientApplication

sendX5c

public boolean sendX5c()

Specified by:

sendX5c in interface IConfidentialClientApplication

Returns:

a boolean value which determines whether x5c claim (public key of the certificate) will be sent to the STS.

clientId

public String clientId()

Gets the client ID (application ID) for this application.

Returns:

Client ID (Application ID) of the application as registered in the application registration portal (portal.azure.com) and as passed in the constructor of the application

authority

public String authority()

Gets the authority URL for this application.

Returns:

URL of the authority, or security token service (STS) from which MSAL will acquire security tokens. Default value is IApplicationBase.DEFAULT_AUTHORITY

validateAuthority

public boolean validateAuthority()

Gets whether the authority URL should be validated against a list of known authorities.

Returns:

A boolean value which determines whether the authority needs to be verified against a list of known authorities. When true, MSAL will validate the authority against a list of well-known authorities. Set to false only for development/testing with custom authority URLs.

getAuthorizationRequestUrl

public URL getAuthorizationRequestUrl(AuthorizationRequestUrlParameters parameters)

Computes the URL of the authorization request letting the user sign-in and consent to the application. The URL target the /authorize endpoint of the authority configured in the application object.

Once the user successfully authenticates, the response should contain an authorization code, which can then be passed in to AbstractClientApplicationBase.acquireToken(AuthorizationCodeParameters) to be exchanged for a token.

Parameters:

parameters - AuthorizationRequestUrlParameters containing the details needed to create the authorization URL, such as scopes, response type, and redirect URI

Returns:

URL of the authorization endpoint where the user can sign-in and consent to the application

acquireToken

public CompletableFuture<IAuthenticationResult> acquireToken(AuthorizationCodeParameters parameters)

Acquires security token from the authority using an authorization code previously received.

This is typically used as the second step in an authorization code flow, after the user has authenticated and provided consent at the authorization endpoint, resulting in an authorization code.

Parameters:

parameters - AuthorizationCodeParameters containing the authorization code and other information required to exchange the code for tokens

Returns:

A CompletableFuture object representing the IAuthenticationResult of the call, which contains the requested tokens and account information

acquireToken

public CompletableFuture<IAuthenticationResult> acquireToken(RefreshTokenParameters parameters)

Acquires a security token from the authority using a refresh token previously received. Can be used in migration to MSAL from ADAL, and in various integration scenarios where you have a refresh token available.

Parameters:

parameters - RefreshTokenParameters

Returns:

A CompletableFuture object representing the IAuthenticationResult of the call.

acquireTokenSilently

public CompletableFuture<IAuthenticationResult> acquireTokenSilently(SilentParameters parameters)
                                                              throws MalformedURLException

Returns tokens from cache if present and not expired or acquires new tokens from the authority by using the refresh token present in cache.

Parameters:

parameters - instance of SilentParameters

Returns:

A CompletableFuture object representing the IAuthenticationResult of the call.

Throws:

MalformedURLException - if authorityUrl from parameters is malformed URL

getAccounts

public CompletableFuture<Set<IAccount>> getAccounts()

Returns accounts in the cache

Returns:

set of unique accounts from cache which can be used for silent acquire token call

removeAccount

public CompletableFuture removeAccount(IAccount account)

Removes IAccount from the cache

Parameters:

account - instance of Account to be removed from cache

Returns:

CompletableFuture object representing account removal task.

logPii

public boolean logPii()

Gets whether personally identifiable information (PII) is included in log messages.

Returns:

A boolean value which determines whether PII (personally identifiable information) will be included in log messages. When true, PII will be logged; when false, PII will be masked or omitted from logs.

correlationId

public String correlationId()

Gets the correlation ID used for tracing requests through the authentication system.

Returns:

Correlation ID which is used for diagnostics purposes and is attached to token service requests. The default value is a random UUID.

httpClient

public IHttpClient httpClient()

Gets the HTTP client used by the application for all HTTP requests.

Returns:

Instance of IHttpClient used by the application for network communication with the Microsoft identity platform.

proxy

public Proxy proxy()

Gets the proxy configuration used by the application for network communication.

Returns:

Proxy used by the application for all network communication. Returns null if no proxy is configured.

sslSocketFactory

public SSLSocketFactory sslSocketFactory()

Gets the SSL socket factory used by the application for secure network communication.

Returns:

SSLSocketFactory used by the application for all secure network communication. Returns null if no custom SSL socket factory is configured.