Edit

Share via

Authenticate Java apps to Azure services during local development by using service principals

During local development, applications need to authenticate to Azure to access various Azure services. You can authenticate locally by using one of the following approaches:

This article explains how to use an application service principal. For more information about service principals, see Application and service principal objects in Microsoft Entra ID. In this article, you learn:

  • How to register an application with Microsoft Entra to create a service principal.
  • How to use Microsoft Entra groups to efficiently manage permissions.
  • How to assign roles to scope permissions.
  • How to authenticate by using a service principal from your app code.

Using dedicated application service principals enables you to follow the principle of least privilege when accessing Azure resources. You can limit permissions to the specific requirements of the app during development to prevent accidental access to Azure resources intended for other apps or services. This approach also helps you avoid problems when you move the app to production by ensuring it isn't over-privileged in the development environment.

A diagram that shows how a local Java app uses a service principal to connect to Azure resources.

When you register the app in Azure, an application service principal is created. For local development, you should:

  • Create a separate app registration for each developer working on the app so each developer has their own application service principal and doesn't need to share credentials.
  • Create a separate app registration for each app to limit the app's permissions to only what is necessary.

During local development, set environment variables with the application service principal's identity. The Azure Identity library reads these environment variables to authenticate the app to the required Azure resources.

Register the app in Azure

Application service principal objects are created through an app registration in Azure using either the Azure portal or Azure CLI.

  1. In the Azure portal, use the search bar to navigate to the App registrations page.

  2. On the App registrations page, select + New registration.

  3. On the Register an application page:

    • For the Name field, enter a descriptive value that includes the app name and the target environment.
    • For the Supported account types, select Accounts in this organizational directory only (Microsoft Customer Led only - Single tenant), or whichever option best fits your requirements.

  4. Select Register to register your app and create the service principal.

    A screenshot showing how to create an app registration in the Azure portal.

  5. On the App registration page for your app, copy the Application (client) ID and Directory (tenant) ID and paste them in a temporary location for later use in your app code configurations.

  6. Select Add a certificate or secret to set up credentials for your app.

  7. On the Certificates & secrets page, select + New client secret.

  8. In the Add a client secret flyout panel that opens:

    • For the Description, enter a value of Current.
    • For the Expires value, leave the default recommended value of 180 days.
    • Select Add to add the secret.

  9. On the Certificates & secrets page, copy the Value property of the client secret for use in a future step.

    Note

    The client secret value is only displayed once after the app registration is created. You can add more client secrets without invalidating this client secret, but there's no way to display this value again.

Create a Microsoft Entra group for local development

Create a Microsoft Entra group to encapsulate the roles (permissions) the app needs in local development rather than assigning the roles to individual service principal objects. This approach offers the following advantages:

  • Every developer has the same roles assigned at the group level.
  • If a new role is needed for the app, it only needs to be added to the group for the app.
  • If a new developer joins the team, a new application service principal is created for the developer and added to the group, ensuring the developer has the right permissions to work on the app.

  1. Navigate to the Microsoft Entra ID overview page in the Azure portal.

  2. Select All groups from the left-hand menu.

  3. On the Groups page, select New group.

  4. On the New group page, fill out the following form fields:

    • Group type: Select Security.
    • Group name: Enter a name for the group that includes a reference to the app or environment name.
    • Group description: Enter a description that explains the purpose of the group.

    A screenshot showing how to create a group in the Azure portal.

  5. Select the No members selected link under Members to add members to the group.

  6. In the flyout panel that opens, search for the service principal you created earlier and select it from the filtered results. Choose the Select button at the bottom of the panel to confirm your selection.

  7. Select Create at the bottom of the New group page to create the group and return to the All groups page. If you don't see the new group listed, wait a moment and refresh the page.

Assign roles to the group

Next, determine what roles (permissions) your app needs on what resources and assign those roles to the Microsoft Entra group you created. Groups can be assigned a role at the resource, resource group, or subscription scope. This example shows how to assign roles at the resource group scope, since most apps group all their Azure resources into a single resource group.

  1. In the Azure portal, navigate to the Overview page of the resource group that contains your app.

  2. Select Access control (IAM) from the left navigation.

  3. On the Access control (IAM) page, select + Add and then choose Add role assignment from the drop-down menu. The Add role assignment page provides several tabs to configure and assign roles.

  4. On the Role tab, use the search box to locate the role you want to assign. Select the role, and then choose Next.

  5. On the Members tab:

    • For the Assign access to value, select User, group, or service principal .
    • For the Members value, choose + Select members to open the Select members flyout panel.
    • Search for the Microsoft Entra group you created earlier and select it from the filtered results. Choose Select to select the group and close the flyout panel.
    • Select Review + assign at the bottom of the Members tab.

    A screenshot showing how to assign a role to the Microsoft Entra group.

  6. On the Review + assign tab, select Review + assign at the bottom of the page.

Set the app environment variables

At runtime, certain credentials from the Azure Identity library, such as DefaultAzureCredential, EnvironmentCredential, and ClientSecretCredential, search for service principal information by convention in the environment variables. When working with Java, you can configure environment variables in different ways depending on your tooling and environment.

Regardless of the approach you choose, configure the following environment variables for a service principal:

  • AZURE_CLIENT_ID: Used to identify the registered app in Azure.
  • AZURE_TENANT_ID: The ID of the Microsoft Entra tenant.
  • AZURE_CLIENT_SECRET: The secret credential that was generated for the app.

Add the following lines to your ~/.bashrc or ~/.zshrc file. Replace the placeholder values with the actual values from your app registration:

export AZURE_CLIENT_ID="<your-client-id>"
export AZURE_TENANT_ID="<your-tenant-id>"
export AZURE_CLIENT_SECRET="<your-client-secret>"

After editing the file, run source ~/.bashrc or source ~/.zshrc to apply the changes to your current session.

Authenticate to Azure services from your app

The Azure Identity library provides various credentials - implementations of TokenCredential that support different scenarios and Microsoft Entra authentication flows. The following steps show you how to use ClientSecretCredential when you work with service principals locally and in production.

Implement the code

Add the azure-identity dependency to your pom.xml file:

<dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-identity</artifactId>
</dependency>

You access Azure services by using specialized client classes from the various Azure SDK client libraries. For any Java code that creates an Azure SDK client object in your app, follow these steps:

  1. Import the ClientSecretCredentialBuilder class from the com.azure.identity package.
  2. Create a ClientSecretCredential object by using ClientSecretCredentialBuilder with the tenantId, clientId, and clientSecret.
  3. Pass the ClientSecretCredential instance to the Azure SDK client object builder's credential method.

An example of this approach is shown in the following code segment:

import com.azure.identity.ClientSecretCredential;
import com.azure.identity.ClientSecretCredentialBuilder;
import com.azure.storage.blob.BlobServiceClient;
import com.azure.storage.blob.BlobServiceClientBuilder;

String tenantId = System.getenv("AZURE_TENANT_ID");
String clientId = System.getenv("AZURE_CLIENT_ID");
String clientSecret = System.getenv("AZURE_CLIENT_SECRET");

ClientSecretCredential credential = new ClientSecretCredentialBuilder()
    .tenantId(tenantId)
    .clientId(clientId)
    .clientSecret(clientSecret)
    .build();

BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
    .endpoint("https://<account-name>.blob.core.windows.net")
    .credential(credential)
    .buildClient();

Next steps

This article covered authentication through a service principal. This form of authentication is one of many ways you can authenticate in the Azure SDK for Java. The following articles describe other ways to authenticate:

If you run into problems related to service principal authentication, see Troubleshoot service principal authentication.

After you master authentication, see Configure logging in the Azure SDK for Java for information on the logging functionality provided by the SDK.

  • Last updated on