Java SDK - Azure Identity - should I handle DefaultAzureCredential's accessToken expiry?

Question

Java SDK - Azure Identity - should I handle DefaultAzureCredential's accessToken expiry?

Kristóf Nalesnyik 101

Hi,

I would like to know whether I should handle DefaultAzureCredential's accessToken expiry or is it handled by the SDK?
I use DefaultAzureCredential, as it works locally and also on cloud when ManagedIdentity is needed for authenticating to KeyVault.

I intend to deploy a function app to Azure Cloud, where I have the following static constructor of my class containing the functions:
static {
final DefaultAzureCredential credential = new DefaultAzureCredentialBuilder().build();

        CertificateClient certificateClient = new CertificateClientBuilder()
                .vaultUrl(KEY_VAULT_URI)
                .credential(credential)
                .buildClient();

        SecretClient secretClient = new SecretClientBuilder()
                .vaultUrl(KEY_VAULT_URI)
                .credential(credential)
                .buildClient();

        service = new Service(certificateClient, secretClient);
    }

I would like to create the service only once with certificateClient and secretClient.
Then if accessToken expires, get new accessToken.
Question: Does Azure Java SDK handles accessToken & refreshToken expiry or is it my task to handle expiry?

Azure Identity dependency: version 1.3.6

1 answer

Your answer

Answer 1

Shweta Mathur 30,296 Microsoft Employee Moderator

Hi @ KristfNalesnyik-1870

TokenCredential is the interface for all the credential classes that provide the token.

If you are using GetToken() or GetTokenAync() method directly to get access token , then token caching and token refreshing is not supported by defaultAzureCredential. This need to be handle by caller in this case.

Reference - https://learn.microsoft.com/en-us/java/api/com.azure.core.credential.tokencredential?view=azure-java-stable

However, You can use BearerTokenAuthenticationPolicy to cache TokenCredential using HttpPipeline Policy.
or You can use MSAL library in place of Azure Identity that can get access token using Managed identity and manage caching and refresh token.

Kristóf Nalesnyik 101 Reputation points

2021-10-08T09:17:49.523+00:00

Hi @Shweta Mathur

Thanks for your answer.

I do not use either GetToken() or GetTokenAsync(). Does the SDK handle token caching & refreshing in this case?
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2021-10-08T09:41:06.44+00:00

@Kristóf Nalesnyik defaultAzureCredential doesn't provide token caching and refreshing in that case as well as TokenCredential interface doesn't support caching in Azure Identity.
Kristóf Nalesnyik 101 Reputation points

2021-10-11T09:30:14.543+00:00

@Shweta Mathur
The docs says:
"getToken(TokenRequestContext request) - Asynchronously get a token for a given resource/audience. This method is called automatically by Azure SDK client libraries..."

In my case the Azure SDK client libraries are CertificateClient and SecretClient. And I would like to know whether these libraries handle caching or not. And I cannot figure out by the docs.

Thanks
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2021-10-12T07:55:17.903+00:00

@Kristóf Nalesnyik

Apologies for creating the confusion with the document mentioned above.

The tokenCredential is interface for defaultAzureCredential which in build calls getToken() or getTokenSync() to get the access token but doesn't support caching and refreshing of the resultant token.

For more clarity , caching depends on the type of credentials that gets used. I don’t think any of the credential implementation provide token caching except the MSAL libraries which has built-in memory cache per instance. e.g ConfidentialClientApplication.

In this case as you are passing defaultAzureCredential to get the access token in certificateClient and secretClient which are part of Azure.Identity and not of MSAL , then you need to handle the caching of resulting token in your code.

Hope this will give you more clarity on usage of credentials and caching.

Share via

Java SDK - Azure Identity - should I handle DefaultAzureCredential's accessToken expiry?

1 answer

Your answer