►
Description
This month’s in-depth topic: Securing your Java Web Apps and APIs with Microsoft Identity - the Microsoft Authentication Library for Java enables applications to integrate with the Microsoft identity platform. It allows you to sign in users or apps with Microsoft identities (Azure AD, Microsoft accounts and Azure AD B2C accounts) and obtain tokens to call Microsoft APIs such as Microsoft Graph or your own APIs registered with the Microsoft identity platform. It is built using industry standard OAuth2 and OpenID Connect protocols. Presenter Didun Ayodeji – Program Manager, Microsoft Identity. Recorded April 21, 2022.
Learn more
• See the full blog post for this call at: https://aka.ms/m365pnp/community/blog
• Download the recurrent invite for this call | https://aka.ms/IDDevCommunityCalendar
• Microsoft 365 Unified Sample gallery - https://aka.ms/m365/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/m365/videos
• Microsoft 365 Platform Community - http://aka.ms/m365pnp
A
So
here's
the
agenda
for
today
we're
going
to
start
with
what
is
identity,
dive
into
authentication
and
authorization,
and
then
I'm
going
to
give
you
an
overview
of
the
microsoft
authentication,
libraries
mso,
then
we're
going
to
shift
our
focus
to
m
cell
java.
Specifically
after
that,
I'm
going
to
demo
three
of
the
samples
we
have
online
and
ready
for
you
and,
lastly,
I'm
going
to
show
you
our
new
and
improved
java
sample
organization
and
to
also
show
you
the
wealth
of
our
samples.
A
A
A
Authorization
takes
place
after
you've
been
authenticated.
Authorization
is
to
check
that
you
have
permission
to
access
a
specific
resource
at
the
bank.
I
only
have
permission
to
access
bank
accounts
that
I
am
a
listed
owner,
whether
it's
my
personal
account
or
an
account
shared
with
a
family
member,
for
example,
notice.
It's
a
private
conversation
between
the
user
and
the
identity
platform.
A
The
private
conversation
generates
artifacts
left
on
the
machine,
such
as
a
cookie.
So
next
time
the
user
makes
an
authorization
or
authentication
request.
They
don't
need
to
type
in
their
password
or
use
mfa
again.
Cookies
do
expire,
though
how
soon
they
expire
correlates
with
the
sensitivity
of
the
data,
for
example,
when
banking
online,
you
tend
to
get
logged
out
after
about
10
minutes,.
B
A
A
A
However,
when
we
decrypt
it,
this
is
what
the
token
looks
like
so
first,
you
can
see
type
at
the
top.
Jwt
stands
for
json
web
token
sometimes
referred
to
as
a
job,
and
then
you
have
more
information
such
as
the
issuer
is
the
idp
that
the
app
trusts
you
can
see
the
audience,
which
is
your
own
application,
and
you
can
also
see
exp
as
and
when
the
token
is
going
to
expire.
A
Iat
is
issue
that
time
and
there
are
even
more
claims.
The
claims
are
about
how
long
the
token
is
valid
for,
but
then
you
also
have
claims
that
tell
you
information
about
the
user.
The
application
needs
this
user
info,
so
they
get
the
object,
id
and
decide
what
needs
to
be
displayed
and
guides
the
user
experience.
A
A
Now
we're
going
to
talk
about
microsoft,
identity,
it's
how
you
build
applications
and
integrate
identity
with
one
unified
toolkit.
The
platform
helps
you
build
applications
to
sign
in
users
and
access
resources
and
external
applications,
such
as
microsoft,
office,
365,
the
azure
portal
and
thousands
of
other
software
as
a
service
application.
A
It
also
allows
developers
to
build
applications
that
users
and
customers
can
sign
into
using
social
accounts
like
facebook
and
google
m
sub
microsoft.
Authentication
library
is
a
set
of
libraries
that
includes
javascript.net
android
java
and
many
more
msl
enables
you
to
acquire
tokens
from
the
microsoft
identity
platform
to
authenticate
users
and
access
web
apps
web
apis.
Mobile
desktop
and
more
purpose
is
to
help
authenticate
and
authorize
users
in
apps
msl
supports
various
oauth
flows
like
authorization,
code
flow
and
client
credential
flow,
and
many
more
emsa
acquires
tokens
on
behalf
of
user.
A
It
maintains
a
token
cache
and
refreshes
them
for
you
when
they're
close
to
expiring,
so
you
don't
have
to
worry
about
getting
a
new
one.
It
helps
you
specify
which
audience
you
want.
Your
applications
to
sign
in
this
can
be
your
work.
Your
school,
your
org
social
identities,
with
azure,
azure,
ad
b2c,
business,
consumer
and
more
here
are
the
scenarios
that
msl
java
covers
web
apps
web
apis,
desktop,
apps
and
more
no
matter
what
application
you
have.
We
can
protect
you
so
now
bear
with
me.
A
A
A
So
when
you
create
an
application,
you
get
sent
to
the
overview
page
for
the
app
you
just
made.
You
have
information
like
your
app
id
client
id
directory,
sometimes
known
as
tenant
id
and
then
another
step
that
I've
already
done
is
create
an
app
secret.
All
you
have
to
do
is
click
new
client
secret
pick
the
name
and
choose
how
long
it
lasts
for
mind.
You,
though,
you
need
to
make
sure
that
you
store
the
secret
in
a
safe
place
because,
after
creating
it,
you
won't
be
able
to
retrieve
it.
A
We
presented
like
this
going
back
to
the
overview
page.
I
created
an
app
that's
been
registered
in
azure
and
to
create
a
relationship
of
trust
between
my
application
and
the
identity
platform.
This
is
why
I've
done
this
on
the
overview
page
for
that
registered
app
in
azure.
You
can
see
its
client
id
and
my
tenant
id,
which
will
allow
my
application
to
uniquely
identify
my
registered
app
and
access
the
identity
platform
using
msl.
A
A
A
A
A
A
You
can
also
see
the
home
page
has
a
slightly
different
url
than
when
we're
using
the
spring
framework.
So
behind
the
scenes
I'm
going
to
stop
the
spring
server
and
start
up
the
tomcat
server.
Please
bear
with
me,
while
the
tomcat
server
is
getting
up
and
running,
to
talk
a
little
bit
more
so
in
the
samples
you'll
see
that
you
have
to
build
a
war
file
when
you're
using
tomcat,
and
I
did
that
offline
and
so
you'll
see
when
you
go
to
github,
you
have
all
the
instructions
clearly
laid
out
for
you.
A
A
A
One
thing
to
note:
when
you
do
this:
for
the
first
time
you
get
presented
a
page
that
talks
about
app
permissions
and
consent.
What
are
you
going
to
allow
the
app
to
access
on
your
behalf
and
the
reason
you're
not
seeing?
This
is
because
I
already
granted
these
applications
permission,
but
something
to
know
when
you
first
do
when
you
first
run
through
the
samples
you
will
get
a
page
that
talks
about
the
permissions
that
you
want
to
grant
the
app
and
success
where
you're
signed.
In
put
the
id
token
details
you
can
see.
A
A
A
A
While
weblogic
gets
up
and
running,
we
have
the
steps
and
I'll
be
showing
you
later.
When
I
go
over
through
the
github
organization
to
make
some
modifications
from
the
authentication.properties
files,
I
was
just
showing
you
tomcat,
so
I'm
going
to
navigate
back
to
visual
studio
code
and
so
like
I
was
referring
to
earlier
with
tomcat.
A
You
have
to
build
a
war
file
to
run
tomcat
and
run
web
logic
and
so
to
run
those
applications.
That
meant
that
I
did
have
to
change
certain
things.
So
after
getting
tomcat
to
work,
I
had
to
change
8080
to
7001,
but
that's
reflected
in
the
warfare
that
I
built
for
weblogic
and
additionally,
some
other
files
that
had
to
be
changed,
and
we
have
these
steps
for
you
in
our
samples.
A
A
A
A
A
Going
back
to
the
top,
I'm
going
to
start
with
the
spring
framework
web
app
tutorial,
our
tutorials
are
broken
down
into
chapter
wise
modules.
So,
no
matter
where
you
are
and
the
process
you
can
dive
right
in
if
you've
already
set
up
everything
from
signing
of
azure
id
all
the
way
to
acquiring
an
id
token.
With
the
rose
claim,
you
can
go
straight
to
deploying
to
azure
app
service.
A
A
Tell
you
the
prerequisites,
show
you
where
you
have
the
clone
and
then
like
the
steps.
I
was
talking
about
earlier,
navigating
to
azure
portal
to
create
your
new
application
entering
the
redirect
uri
configuring,
the
web
app
in
a
yaml
file
where
your
yaml
file
is
located
in
the
assembly.
You
download
some
of
the
information
that
I
had
to
change
in
the
ml
file
to
connect
my
app
to
azure
id
the
commands
for
running
the
sample
and
the
expected
page.
You
should
see.
A
A
A
If
you're
trying
to
have
someone
get
authenticated
that
is
they're
trying
to
sign
in
on
a
device
that
doesn't
have
the
best
user
experience
when
typing,
but
there's
just
not
a
keyboard
available
at
all.
For
example,
you
might
have
a
smart
tv
or
an
advanced
device
like
a
smart
speaker
or
printer
msl
device
code
is
for
you
to
give
you
another
example.
A
A
A
A
B
Awesome
that
was
brilliant.
I
mean
it
was
very
insightful
session.
It's
great
to
know.
You
know
you
can
use
java
pretty
much
everywhere
and
you,
your
session,
really
put
it
out
well
with
the
demos
and
good
to
see
a
lot
of
github
samples
and
you
know
detailed
instructions.
We
have
some
questions
in
the
chat
as
well.
As
you
know,
we
would
like
to
take
some
more
questions.
D
B
Hope
that
answers
your
question
starkey.
The
next
question
is,
I
think,
it's
around
acronyms.
What
is
the
acronym
for
service
principle?
Is
it
spn
which
it
sounds
like
compromises,
service,
principal
name,
our
service
principle?
Isn't
service
principle
name?
So
what
so?
No
n,
therefore
it's
just
sp
or
is
it
spo
service
principle
object.
A
Yeah,
I
think
a
lot
of
times
when
I'm
in
meetings
and
seeing
people
present
about
service
principle.
They
normally
have
it
typed
out
fully.
So
I
can't
speak
too
much
on
the
acronyms
that
I've
seen
in
the
past.
I
do
think
it's
really
funny
about
you,
saying
that
the
sharepoint
folks
would
be
angry
if
he
made
an
sdo.
B
A
Yeah,
so
I'm
not
too
familiar
with
our
ios
library,
because
I
don't
work
in
the
ios
space
at
all,
but
I
would
say
that
the
amazon
ios
libraries
for
sure
would
have
a
lot
of
resources
available
to
you.
It
would
be.
I
can
show
you
the.
I
can
add
the
link
to
our
amsa
ios
library
in
a
second,
but
I
would
say
that
it's
extremely
extremely
informative
when
you
navigate
to
their
website.
There
are
ton
of
samples
for
you
and
the
team
that
works
on.
It
is
extremely
active.
A
B
Let
me
try
to
get
some
more.
You
know
I'll
try
to
connect
with
the
ios
team
and
try
to
get
you
some
information
I'll
try
to
put
it
in
the
chat.
Maybe
it
may
take
a
couple
of
days
for
me,
but
I'll
have
something
for
you.
The
next
question
is
in
api
or
id
token
validation.
Can
you
share
slash
point
out?
How
can
we
use
token
signature,
validation.
D
I
could
also
chime
in
a
bit
on
that
so
token,
validation
and
prion.
You
had
a
bunch
of
other
questions:
token
validation,
continuous
access,
evaluation
and
pop
token
validation.
Those
are
all
features
that
we're
going
to
be
having
soon,
probably
in
this,
like
work
quarter
or
that
we
have
planned
for
future
work.
C
D
So
you
can
validate
the
token
signature
using
a
separate
library
that
we
do
a
little
bit
of
validation
just
for
more
like
the
formatting
of
stuff,
but
for
signature
validation,
it's
a
something
that
we're
going
to
be
having
as
a
feature
upcoming,
but
I
think
like
it.
We
hadn't
been
asked
about
it
before
until
kind
of
recently
yeah.
C
So
the
answer
is
yeah.
The
answer
is
no
msall
java
cannot
validate
the
signature
of
the
token.
That
means
msal
java
cannot
make
sure
that
the
token
is
issued
by
azure
ready
yeah.
Currently,
it
doesn't
so
even
if
you
migrate
the
application,
the
web
applications
or
web
apis,
the
other
other
patterns
like
obos
and
everything
to
msol
the
token
signature
validation
part
still.
We
have
to
use
the
other
libraries
whatever
we
are
currently
using.
C
Fine
sure
thanks.
My
second
question
is
about
continuous
access
evaluation,
so
we
we
so,
and
we
are
experienced
that
the
dotnet
libraries
are
giving
this
continuous
access
evaluation,
and
we
can
actually
do
that
authentication
context.
If
we
can
request
if
it
is
not
there,
we
can
again
redirect
so
that
feature
is
also
not
available
in
msl
java,
correct.
C
D
B
B
Okay,
there's
a
question
which
you
know
concerning
existing
server
side,
separate
apps
with
app
servers,
tomcat
web
logic,
webs
3
jboss
for
those
scenarios
where
we
have
to
migrate
existing
applications
that
use
the
java
ee
security
mechanisms.
We
have
to
remove
the
declarative
elements
or
annotations
like
add,
select,
security
and
refactor.
They
have
to
use
themselves
for
java.
Is
that
right?
D
E
That's
correct,
you
know,
because
I'm
just
considering
a
migration
scenario,
let's
say
that
I
have
a
server
based
application.
You
know
war
files
and
so
on,
servlets
java
surfaces,
anything
you
know
with
the
existing
usual
security
mechanisms
that
are
enforced.
You
know
in
a
declarative
way
by
the
web
xml
file
or
the
usual
annotations.
You
know
for
security
in
order
to
use
I'm
so
for
java.
E
E
C
D
Currently,
we
don't
really
do
anything
with
that,
like
in
the
library,
because
it's
more
meant
for
like
any
any
time
that
we
would
get
it
or
deal
with
it.
It's
just
use
server
side,
so
nothing
that
we
do
really
messes
with
it.
But
if
you're
receiving
that
in,
like
a
token
that
dot
net
receives,
you
should
be
receiving
the
same
information
like
in
the
tokens
that
insult
java
receives.
C
C
D
D
C
Fine
thanks
yeah
dotnet
from
our
experience
we
have
seen
cookies,
which
is
which
is
set
using
nouns
value
and
then
the
last
redirection
can
happen
only
if
that
noun's
value
is
present.
That
ovin
library
is
checking
whether
that
nouns
cookie
is
present
or
not.
If
not,
it
will
go
for
a
reader,
I
mean
authentication,
it
will
go
for
a
redirection
to
authenticate
again,
but
the
same
kind
of
flow.
If
you
go
to
the
network
traffic,
that's
not
available
in
insult
java.
D
B
And
it
looks
like
steven
has
already
answered,
shiv
shankar's
question
on
asm
authentication,
as
in
msl
ios.
If
you
need
any
more
clarification,
feel
free
to
come
off
me
or
shushankar.
If
you're
good
with
the
answer,
yeah
then
be
good
all
right.
Okay,
thanks
a
lot.
Everyone
for
your
call.
Thank
you.
Did
you
thank
you
every
for
the
q,
a
the
presentation,
it
was
all
great.
Did
you
have
anything
else
to
add
every
you
do.
B
Hey
folks,
it
would
be
great
if
you
could
go
ahead
and
fill
in
the
survey
for
us.
This
really
helped
us
to
sort
of
like
plan
our
sessions.
The
questions
are
more
around
what
you
would
like
and
how
was
this
current
session
and
things
of
that
it
would
not
take
more
than
a
minute
for
you
to
sort
of
fill
in
this
away
yeah.
It
would
be
great
if
you
could
take
a
minute
and
do
that
for
us.
B
So
just
to
recap,
you
will
be
getting
access
to
this
videos.
M365
bnb,
slash
videos.
You
can
follow
the
twitter
as
well
as
like
the
twitter
channels,
microsoft,
365,
dev
and
azure
ad
for
the
recording
or
the
next
calls,
and
all
that
we
have
an
exciting
call
coming
up
for
you
on
may
19th,
looking
forward
to
having
you
all
on
that
call.