DEV Community: Brundha S V

MS Graph API Certificate and Client Secret OAuth2.0 in Java Spring boot

Brundha S V — Sun, 03 Nov 2024 09:27:53 +0000

Overview

Microsoft Graph API is a gateway to data and service management in Microsoft 365. An access token is required to call MS Graph APIs. In this article we learn how to obtain OAuth access token with a certificate or a secret. This approach is best suited for Admin-Consent Apps that needs access without a user, more info here.

Code Overview

Access Full code here

brundhasv / MSGraphclientCreds

MS Graph API Certificate and Client credentials OAuth2.0 in Java Spring boot

Overview

Microsoft Graph API is a gateway to data and service management in Microsoft 365. An access token is required to call MS Graph APIs. This repo can be used obtain OAuth access token with a certificate or a secret. This approach is best suited for Admin-Consent Apps that needs access without a user, more info here.

Usage

    String MS_TENANT_ID = "<YOUR_MS_TENANT_ID_HERE>";

    /** 1. Fetch token using certificate */
    AuthResponse response = AuthClient.fetchNewToken(MS_TENANT_ID,"cert");
    log.info("Token Response using Certificate : {}",response);

    /** 2. Fetch token using secret */
    response = AuthClient.fetchNewToken(MS_TENANT_ID,"secret");
    log.info("Token Response using Secret : {}",response);

Explanation of Code here:

https://dev.to/brundhasv/ms-graph-api-certificate-and-client-credentials-authentication-in-java-spring-boot-3hc7

View on GitHub

Language used - Java Springboot
Libraries - security library nimbus and bouncycastle
Project - Maven

pom.xml

<dependency>
    <groupId>com.nimbusds</groupId>
    <artifactId>oauth2-oidc-sdk</artifactId>
    <version>11.10</version>
</dependency>
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk18on</artifactId>
    <version>1.76</version>
</dependency>

Access token request with a Certificate

OAuth2 Client credentials flow is supported by MS Graph API to obtain access token using certificate. Certificate Auth is recommended over to secret Auth.
Prerequisite- Your certificate needs to be uploaded under your 'App Registration>Certificates & Secrets'. You can also use self-signed certificate if deployed in local environment.
Reference- Link

Code Explanation

Use MS token URL and MS App id and uploaded certificate to obtain oauth2 access token.

Populate MS OAuth Token URL, scope and your Entra App id and certificate and its key path in Constants.java. PEM certificate is used in this example. Certificate key is needed to sign JWT Token.

public class Constants {
    //ms app client/app id
    public static final String MS_APP_CLIENT_ID = "<YOUR_MS_APPLICATION_ID_HERE>";

    //ms graph api oauth token url
    public static final String MS_APP_TOKEN_URL =
            "https://login.microsoftonline.com/%s/oauth2/v2.0/token";

    //ms graph api oauth token url
    public static final String MS_APP_TOKEN_SCOPE = "https://graph.microsoft.com/.default";

    //client certificate details
    public static final String CERT_PATH = "<YOUR_CERT_PATH_HERE>";
    public static final String CERT_KEY_PATH = "<YOUR_CERT_KEY_PATH_HERE>";
}

Create signed JWT token in the format specified by MS assertion-format

JWTHeader
Create JWT header using public key from certificate. PEM type cert is used in this example.

X509Certificate cert = getPublicKeyFromCert(Constants.CERT_PATH);
String thumbprint = getThumbprint(cert);
Map<String, Object> jwsMap = new HashMap<>();
jwsMap.put("alg", HEADER_ALG);
jwsMap.put("typ", HEADER_TYP);
jwsMap.put("x5t", thumbprint);
JWSHeader jwsHeader = JWSHeader.parse(jwsMap);
log.debug("JWT header - {}", jwsHeader.toJSONObject());
return jwsHeader;

JWTClaims
Certificate Claims is built as specified by MS, setting expiration for 10mins and issuer/subject as App client id.

LocalDateTime localDate = LocalDateTime.now();
Date dateNow = Date.from(localDate.atZone(ZoneId.systemDefault()).toInstant());
LocalDateTime localDateExp = localDate.plus(Duration.ofMinutes(JWT_EXPIRY_MINS));
Date dateExp = Date.from(localDateExp.atZone(ZoneId.systemDefault()).toInstant());
UUID uuid = UUID.randomUUID();
JWTClaimsSet jwtClaims =
new JWTClaimsSet.Builder()
        .audience(tokenUrl)
        .issueTime(dateNow)
        .notBeforeTime(dateNow)
        .expirationTime(dateExp)
        .jwtID(uuid.toString())
        .issuer(Constants.MS_APP_CLIENT_ID)
        .subject(Constants.MS_APP_CLIENT_ID)
        .build();

SignedJWT
Using above created JWT header and Claims, create JWT token and finally sign with certificate private key.

 private static SignedJWT createSignedJWT(String tokenUrl) {
    JWSHeader jwsHeader = createJWTHeader();
    JWTClaimsSet jwtClaims = createJWTClaims(tokenUrl);
    SignedJWT signedJWT = new SignedJWT(jwsHeader, jwtClaims);
    RSAPrivateKey certJWK = readPKCS8PrivateKey(Constants.CERT_KEY_PATH);
    try {
        signedJWT.sign(new RSASSASigner(certJWK));
    } catch (Exception e) {
        throw new AuthException("Error while signing JWT", e.toString());
    }
    log.debug("JWT Cert Token for MS App - {}", signedJWT.serialize());
    return signedJWT;
}

Use above created signed JWT to make OAuth request using nimbus library 'PrivateKeyJWT'.

/** Access token request with a certificate */
private static TokenRequest getClientCertTokenRequest(String tenantId)
        throws URISyntaxException {
    String tokenUrl = String.format(Constants.MS_APP_TOKEN_URL, tenantId);
    SignedJWT signedJWT = getSignedJWT(tokenUrl);
    ClientAuthentication clientAuth = new PrivateKeyJWT(signedJWT);
    AuthorizationGrant clientGrant = new ClientCredentialsGrant();
    Scope scope = new Scope(Constants.MS_APP_TOKEN_SCOPE);
    URI tokenEndpoint = new URI(tokenUrl);

    // Make the token request
    return new TokenRequest(tokenEndpoint, clientAuth, clientGrant, scope);
}

Then with your Org/App Tenant Id, fetch token using above method. Tenant Id is MS account Id for your org/domain, this can be found in your Entra App.

@Component
@Slf4j
public class AuthCLI implements CommandLineRunner {

    @Override
    public void run(String... args) throws Exception {
        String MS_TENANT_ID = "<YOUR_MS_TENANT_ID_HERE>";

        /** 1. Fetch token using certificate */
        AuthResponse response = AuthClient.fetchNewToken(MS_TENANT_ID,"cert");
        log.info("Token Response using Certificate : {}",response);
    }
}

Access token request with a Secret

OAuth2 Client credentials flow is supported by MS Graph API to obtain access token using secret.
Prerequisite- You should generate client secret under your 'App Registration>Certificates & Secrets' and note down. This is recommended for test/setup in local environment.
Reference- Link

Code Explanation

Use MS token URL and MS App id and generated secret to obtain oauth2 access token.

Populate MS OAuth Token URL, scope and your Entra App id and generated secret in Constants.java

public class Constants {
    //ms app client/app id
    public static final String MS_APP_CLIENT_ID = "<YOUR_MS_APPLICATION_ID_HERE>";

    //client secret
    public static String MS_APP_CLIENT_SECRET = "<YOUR_MS_CLIENT_SECRET_HERE>";

    //ms graph api oauth token url
    public static final String MS_APP_TOKEN_URL =
            "https://login.microsoftonline.com/%s/oauth2/v2.0/token";

    //ms graph api oauth token url
    public static final String MS_APP_TOKEN_SCOPE = "https://graph.microsoft.com/.default";
}

Use nimbus library 'ClientSecretBasic' to make OAuth 2-legged Token request using above parameters.

/** Access token request with a secret */
private static TokenRequest getClientCredsTokenRequest(String tenantId)
        throws URISyntaxException {
    AuthorizationGrant clientGrant = new ClientCredentialsGrant();

    // The credentials to authenticate the client at the token endpoint
    ClientID clientID = new ClientID(Constants.MS_APP_CLIENT_ID);
    Secret clientSecret = new Secret(Constants.MS_APP_CLIENT_SECRET);
    ClientAuthentication clientAuth = new ClientSecretBasic(clientID, clientSecret);

    Scope scope = new Scope(Constants.MS_APP_TOKEN_SCOPE);
    String tokenUrl = String.format(Constants.MS_APP_TOKEN_URL, tenantId);
    URI tokenEndpoint = new URI(tokenUrl);

    // Make the token request
    return new TokenRequest(tokenEndpoint, clientAuth, clientGrant, scope);
}

Then with your Org/App Tenant Id, fetch token using above method. Tenant Id is MS account Id for your org/domain, this can be found in your Entra App.

@Component
@Slf4j
public class AuthCLI implements CommandLineRunner {

    @Override
    public void run(String... args) throws Exception {
        String MS_TENANT_ID = "<YOUR_MS_TENANT_ID_HERE>";

        /** 2. Fetch token using secret */
        response = AuthClient.fetchNewToken(MS_TENANT_ID,"secret");
        log.info("Token Response using Secret : {}",response);
    }
}

GO Protobuf Encoding/Decoding integrated with C

Brundha S V — Thu, 24 Oct 2019 10:29:02 +0000

Protobuf messages are gaining popularity across many domains. There are libraries like nanopb in C to support the protobuf encoding/decoding. However they are slow and also pose significant challenge in implementation. GoLang protobuf encoding/decoding is fast and provides support of unmarshalling data from JSON to proto format.

We will be creating a C shared library containing functions that read from json file, protobuf encode and decode.

Full Code can be found here:

brundhasv / GoC-Protobuf

Go functions integrated with C

GoC Protobuf Encoding/Decoding

Go functions for Protobuf Encoding/decoding integrated with C

Usage:

protoc --go_out=. Student.proto

go build -o student.so -buildmode=c-shared Student.pb.go student_en_dc.go

gcc -o student student_cgo.c ./student.so

Go program can also be run in standalone mode:

go run student_en_dc.go Student.pb.go

Explanation of Code here:

https://dev.to/brundhasv/go-protobuf-encoding-decoding-integrated-with-c-3ig0

View on GitHub

GoLang Code

Lets start with Student.proto. I am using proto3 for this example:

syntax="proto3";

package main;

message Parents {
      string dad=1;
      string mom=2;
}

enum Gender {
    Female = 0;
    Male = 1;
}

message Student {
      string name = 1;
      int32 age = 2;
      Parents parents=3;
      Gender gender=4;
}

message Students {
      repeated bytes StudentEntry=1;
}

As you can see above proto includes enum, nested proto and repeated bytes. Student represents a student's data, each student's data will be encoded and added to Students StudentEntry and all the encoded entries will be encoded again.

Below is input JSON file student_list.json which is used to populate proto fields. We have to use the same names and nested levels for the unmarshal of Json to proto.

{
"0" : {
    "Name": "Elliot",
    "Age" : 15,
    "Parents" : {
            "Dad" : "George",
            "Mom" : "Elena"
    },
    "Gender" : 0
  },
"1" : {
    "Name": "David",
    "Age" : 14,
    "Parents" : {
            "Dad" : "Keith",
            "Mom" : "Sarah"
    },
    "Gender" : 1
   }
}

Encoding Protobuf from JSON

To integrate with C, library C is used to convert GoData to C datatypes. Comment export is used to export functions to C lib.
We will create a new GoLang program file student_en_dc.go and add encode and decode functions to it.
Json file is input parameter of this function get_student_enbuf passed from C. This function returns encoded buffer and its length to C.

//export get_student_enbuf
func get_student_enbuf(student_json_file *C.char) (unsafe.Pointer,C.int) {
       .
       .
       return C.CBytes(students_en),C.int(int32(len(students_en)))

First step in encoding is to Unmarshall JSON to proto. As there are more than one student entries, I have added entries using number keys. This cannot be directly unmarshalled, we would have to extract json data of each student and then unmarshal. I am first unmarshalling json file data to an interface. Below is the code:

jsonbytes, _ := ioutil.ReadAll(jsonFile)
var parsed_proto map[string]interface{}
json.Unmarshal(jsonbytes, &parsed_proto)

Then parse each interface to obtain student json data and unmarshall it into our proto. Aftermath proto is encoded as shown.

    for i=0;i<len(parsed_proto);i++ {
            selectedjb, err := json.Marshal(parsed_proto[strconv.Itoa(i)])
            if err != nil {
                log.Println("Error in reading json index",err)
                return nil,0
            }
            var parsed_jf map[string]interface{}
            //Each student data to proto
            json.Unmarshal(selectedjb, &parsed_jf)
            student := &Student{}
            //Proto Encoding of student
            json.Unmarshal(selectedjb, student)

Encoded data is added to StudentEntry of Students. Then Students data is encoded. We have the encoded buffer.

            students.StudentEntry=append(students.StudentEntry,student_en)
    }
    students_en, err := proto.Marshal(students)

Decoding protobuf

Students is decoded first following all the student entries.

Function decode_student_enbuf takes encoded data and its length as input passed from C and returns decoded buffer to C.

//export decode_student_enbuf
func decode_student_enbuf(data *C.char,leng C.int) *C.char {
           .
           .
           return C.CString(decoded_student)
}

Before decode, *char is converted to GoBytes and then unmarshalled to proto.

new_students := &Students{}
student_en:=C.GoBytes(unsafe.Pointer(data),leng)
err := proto.Unmarshal(student_en, new_students)

Decoded students data is used to obtain each StudentEntry and is decoded. Decoded student is appended to a string and is returned to C.

for i=0;i<len(new_students.StudentEntry);i++ {
        new_student := &Student{}
        err = proto.Unmarshal(new_students.StudentEntry[i], new_student)
        decoded_student=decoded_student+"\n"+proto.MarshalTextString(new_student)

Building C-Shared file

Lets compile proto to generate Student.pb.go.Then build c-shared file.

protoc --go_out=. Student.proto
go build  -o student.so -buildmode=c-shared Student.pb.go student_en_dc.go

student.so and student.h files are generated.
Following lines would be present in the generated header file. Golang function get_student_enbuf returns tuple(more than one return parameters), this is converted to struct when header files are generated as seen below.

/* Return type for get_student_enbuf */
struct get_student_enbuf_return {
        void* r0;
        int r1;
};

extern struct get_student_enbuf_return get_student_enbuf(char* p0);

extern char* decode_student_enbuf(char* p0, int p1);

C Code

From C side, generated header file is included. Students list JSON file is passed to function get_student_enbuf, returned encoded buffer and its length is populated in struct stu. The same are passed to decode function decode_student_enbuf, the returned decoded string is printed.
Finally both encoded and decoded buffers are freed.

#include <stdio.h>
#include "student.h"
#include <string.h>
#include <stdlib.h>
#include <stdbool.h>

struct get_student_enbuf_return stu;

int main() {
    stu = get_student_enbuf("student_list.json");
    int stu_list_len = stu.r1;
    if(stu.r0!=NULL) {
        char *decoded_stu = decode_student_enbuf((char*)stu.r0,stu.r1);
        if(decoded_stu != NULL){
                printf("%s",decoded_stu);
                free((char*)decoded_stu);
        }
    free((char*)stu.r0);
    }
    return 0;
}

Compiling and executing C

Link with the created student.so, create object student and run the object.

gcc -o student student_cgo.c ./student.so

./student
name: "Elliot"
age: 15
parents: <
  dad: "George"
  mom: "Elena"
>

name: "David"
age: 14
parents: <
  dad: "Keith"
  mom: "Sarah"
>
gender: Male

Full Code can be found here:

brundhasv / GoC-Protobuf

Go functions integrated with C

GoC Protobuf Encoding/Decoding

Go functions for Protobuf Encoding/decoding integrated with C

Usage:

protoc --go_out=. Student.proto

go build -o student.so -buildmode=c-shared Student.pb.go student_en_dc.go

gcc -o student student_cgo.c ./student.so

Go program can also be run in standalone mode:

go run student_en_dc.go Student.pb.go

Explanation of Code here:

https://dev.to/brundhasv/go-protobuf-encoding-decoding-integrated-with-c-3ig0

View on GitHub