►
Description
How Microsoft Graph and Microsoft Identity platform teams are delivering integrated capabilities supporting secure and streamlined Java and Android application development. Topics covered: Microsoft Identity platform overview, Microsoft Authentication Library for Java (MSAL4J) and for Android, Code review - Authentication and Authorization for servlet web apps in 3 easy steps, Overview of Microsoft Graph, New features and improvements in the Java SDK v3.0 for Microsoft Graph, Code review - Using new Java SDK v3.0 capabilities in a console application built with Java. This 40 minute session hosted by the Identity Developer Advisors was recorded on April 7, 2021. Reference materials and Actions called out.
Identity Developer Advisors:
• Navya Canumalla – Program Manager (Microsoft Identity)
• Sam Eslamdoust – SDE (Microsoft Identity)
• Maisa Rissi – Program Manager (Microsoft Graph)
• Vincent Biret – Sr SDE (Microsoft Graph)
Reference:
• Blog Post - Microsoft Graph Java SDK v3 adds enhanced capabilities with general availability | https://aka.ms/ga-javav3
Stay connected:
• Twitter - https://twitter.com/microsoft365dev
• YouTube - https://aka.ms/M365DevYouTube
• Blogs - https://aka.ms/M365DevBlog
• All Microsoft 365 developer community calls – https://aka.ms/M365DevCalls
A
So
the
microsoft
identity
platform
is
built
using
industry
standard
protocols
such
as
oauth
and
openid
connect
for
offering
authentication
and
authorization
services.
It
enables
application
developers
to
sign
in
users
with
microsoft,
identities
like
work
or
school
accounts
on
azure
id
personal
msa
account
or
even
customer
and
partner
accounts
with
their
own
identities.
A
These
capabilities
are
surfaced
through
certified,
open
id
connect,
endpoints
and
application
developers
can
integrate
with
the
platform
using
these
endpoints,
but
to
get
quickly
started.
Developers
can
get
started
on
the
microsoft
identity
platform
by
registering
their
applications
and
then
using
the
microsoft
authentication
libraries
we
provide
to
sign
in
users
and
access
various
protected
apis
secured
by
the
platform
such
as
microsoft
graph.
A
A
Recently
we
released
a
bunch
of
different
samples
for
web
applications
using
m
cell
java,
so
some
of
the
scenarios
we
covered
in
this
sample,
which
is
laid
out
in
a
tutorial
fashion
and
with
multiple
chapters
that
you
can
pick
and
choose
each
chapter,
is
its
own
independent
code
sample
that
you
can
download
and
run.
But
every
subsequent
chapter
allows
you
to
build
over
the
previous
chapter
and
gives
you
that
continuity
of
the
scenario
so
the
different
scenarios
we
have
covered
today.
A
B
So
if
you're
wondering
how
to
add
authorization
and
authentication
to
your
server
web
app
using
the
samples
that
were
just
shown
you
in
the
chapter
wise
tutorial
in
the
previous
slide,
it's
just
in
three
easy
steps.
Just
we
open
the
configuration
file,
we
populate
these
three
settings
that
you
see
in
step
one
here
in
step.
Two.
We
just
call
the
sign
in
method
in
auth
helper,
that's
going
to
utilize,
the
microsoft
authentication
library
for
java
to
complete
the
auth
code
flow.
B
It's
going
to
redirect
the
user
to
azure
ads
login,
endpoint
and
the
user
will
enter
their
details.
Then
their
browser
will
be
redirected
to
the
redirect
endpoint
on
your
server
web
app
with
an
authentication
code.
If
everything
checks
out
there,
the
auth
code
will
be
exchanged
for
an
id
token
and
an
access
token
step.
3
you
get
to
use
the
id
token
to
extract
its
claims.
B
B
B
B
B
Okay,
great
we're
signed
in
so
allow
me
to
show
you
what
happened
right
there.
So,
when
we
clicked
sign
in
this,
this
server
with
the
sign
and
servlets
was
activated,
and
we
use
the
sign
in
method
in
this
auth
helper
cloud.
Helper
is
just
a
a
class
with
some
static
methods
in
it
that
help
us
utilize
and
surfaced.
Some
of
msull,
microsoft,
authentication,
library
for
java's
features
and
this
particular
method
triggers
the
auth
code
sign
in
flow.
B
So
what
it
does
is
call
this
method
here.
It
will
either
authorize.
It
will
either
get
a
token
silently
or
interactively
silently,
if
there's
already
valid
token
in
the
cache.
It
will
use
that
instead
of
asking
the
user
to
log
in
again,
otherwise
it
will
redirect
the
user
to
the
authorization
endpoint
it'll
set
up
some
of
the
parameters
that
are
required
to
do
this.
So
it's
going
to
create
a
random
state,
random
nonce,
save
them
and
pass
these
along
with
the
request
to
login.microsoftonline.com
this
point.
B
When
that
happens,
we've
set
up
set
it
up
so
that
it
redirects
to
the
application,
which
is
in
this
case
it's
local
hosts,
colon8080,
slash,
msul4j,
servlet
graph,
slash
auth,
slash
redirect
over
here
yeah.
We
just
use
auth
helper
to
process
the
azure
80
callback
again
with
a
servlet
adapter
in
there.
B
There's
a
there's,
an
interface
there
called
identity
context,
adapter
and
the
helpers
along
with
helper.
Here
you
can
implement
that
for
your
specific
needs,
if
you're
not
using
a
servlet
here,
we
just
validate
to
make
sure
that
the
response
we're
receiving
is
correct
and
then
we,
if
everything,
checks
out
the
state
matches,
there's
no
errors.
We
will
take
the
off
code
that
we
received
and
send
that
to
the
token
endpoint
of
azure
ad
and
exchange
that,
for
our
id
token
and
access
token
and
then
validate
those
if
those
are
all
valid.
B
We
save
these
to
the
session
so
that
next
that
in
the
next
request
that
the
user
makes
we
can
fully
take
advantage
of
the
id
token
or
the
access
token
or
both.
So
in
this
token,
details,
servlet
we've
created
a
context
adapter
and
then
we've
gotten
the
context,
data
from
it
and
then
here
we
just
filter
out
some
of
the
claims
in
there
to
display
to
the
user.
B
For
example,
let's
take
a
look
at
the
id
token
details.
A
subset
of
the
claims
in
the
id
token
are
displayed
here.
Another
thing
we
can
do
with
this
with
the
data
we've
obtained
from
from
the
token
endpoint
is
one
of
the
other
pieces
that
we've
obtained
was
the
access
token.
Now
that
we
can
use
that
to
access
upstream
resources.
A
But
if
you
would
like
to
see
something
more
in
the
java,
sdks
or
samples,
please
go
ahead
and
fill
out
the
short
poll
that
we
have
in
this
deck
I'll
share
out
the
link,
even
in
the
chat
but
yeah.
Please
feel
free
to
check
out
the
poll
and
take
take
a
few
minutes
to
provide
your
feedback
with
that.
I
think
we
can
hand
it
off
to
the
graph
team
to
go
into
the
graph
sdk.
A
C
C
Now
we
can't
talk
about
the
java
sdk
for
microsoft
graph
without
first
speaking,
about
the
microsoft
graph
itself,
but
what
is
microsoft
graph?
There
are
many
things
that
build
the
applications
and
services
that
makes
the
microsoft
365
ecosystem
in
the
past.
Each
of
these
teams
exposed
their
own
api.
C
C
Here
are
some
of
the
entities
available
in
microsoft.
Graph
developers
can
build
an
app
that,
based
on
a
security
alert
in
a
tenant,
can
traverse
the
graph
to
see
which
users
might
be
affected,
making
it
easy
to
connect
data
from
across
many
services
to
solve
a
real
business
scenario.
Devs
can
also
build
apps
with
richer
content,
assessing
dipping
sites
generated
from
user
partners
such
as
training
documents,
besting
meetings
times
or
people
typically
work
with.
C
Some
of
the
common
scenarios
are
finding
the
onedrive
files
that
a
user
edited
in
word
last
week
or
scheduled
time
for
a
meeting
with
a
group
on
their
outlook.
Calendar
update
a
planner
task
for
a
user
based
on
their
grouping
membership
start
a
new
conversation
thread
for
a
grouping,
microsoft
teams.
C
Best
thing
to
get
started
is
to
head
over
to
ms
slash
ga,
to
try
the
api
with
the
graph
explorer
for
those
who
are
not
familiar
with
graphics
plotter.
It
is
a
customized
developer
tool
that
allows
you
to
try
microsoft
graph
and
offers
a
great
advantage
since
it
handles
authentication
process
for
you,
letting
you
choose
on
signing
to
your
own
tenant
or
use
the
default
sample
tenant,
and
in
addition,
these
two
includes
helpful
features
such
as
code
snippets
for
each
risk.
Api
query
you
select
on
the
left,
sidebar.
C
You
can
see
the
code
under
code
snippets
tab
as
it's
showing
the
print
screen.
You
can
use
graph
explorer
as
a
prototyping
tool
to
fulfill
your
app
scenarios.
Okay,
now
you
know
the
microsoft
graph
and
graph
explorer.
This
brings
us
to
the
next
question:
how
to
integrate
with
microsoft
graph.
Is
it
difficult
to
do
that.
C
C
So
the
library,
the
library,
contains
models
and
requests
builders
that
are
generated
from
microsoft,
graph
metadata
to
handle
the
boilerplate
logic
for
sending
and
receiving
requests.
So
you
can
work
directly
with
the
responses.
Instead
of
writing
http
connection
logic
yourself,
it
is
also
commonly
necessary
to
handle
with
query
results
for
performance
reasons.
Collections
of
entities
are
often
split
into
pages
and
each
page
is
returned
with
a
url
to
the
next
page.
C
C
There
are
many
extensibility
points
with
the
sdk
that
make
it
easier
to
perform
tasks,
graph,
sdks,
embedded
support
for
effective
handling
of
failed
requests
and
redirects
large
file
uploads
through
a
fluent
and
ease
mechanism
for
the
consumer,
to
control,
monitor
and
conceal
the
handling
of
large
loads
and
the
authentication
providers
that
implement
the
code
required
to
acquire
and
use
the
token,
and
now
talking
more
specifically
about
the
new
version.
We
select
a
few
new
features
and
improvements
to
highlight
in
this
call.
C
Taking
this
into
consideration,
the
coastal
interface
to
a
synchronous
request
has
been
removed
and
the
api
now
returns,
completable
future
to
deliver
a
standard,
modern
and
fluent
user
experience
without
uncompromising
on
the
condiment
and
ability
talking
about
fluent
experience.
The
bad
support
has
been
improved
to
provide
a
cleaner
api
service
to
sdk
users.
C
C
We
removed
unnecessary
interface
to
avoid
confusion
and
duplication,
refractored
package
names
and
classes
names
to
clarify
the
intent
of
them
and
moved
all
code
from
the
cersei
library
to
the
core
library.
Since
the
services
library
was
designed
to
contain
code
generated
automatically
from
the
api
metadata.
D
Thank
you
mesa.
So
here
I
have
visual
studio
code
open
to
a
sample
application
and
I'm
going
to
show
you
the
new
features
from
the
java
sdk
v3
in
action.
The
first
part
we
can
see
here
so
first,
I'm
in
a
console
application,
that's
a
very
simple
kind
of
application
based
on
built
on
on
with
java,
and
it
has
limited
ui
capabilities.
D
So
the
first
thing
I'm
doing
here
because
again
microsoft
graph,
is
always
secured
and
be
behind
of
authentication.
As
a
sam
and
navia
told
us
right
before,
I'm
actually
setting
up
the
authentication
context.
In
this
case,
I'm
using
the
new
device
code
credentials
support
that
we
added
with
the
v3
of
the
sdk
from
the
azure
identity
that
also
uses
msl
behind
the
scenes
to
authenticate.
D
So
the
first
thing
I'm
doing
here
is
creating
the
device
code,
credential
passing
it.
My
client
id
my
tenant
id
and
it
will
print
a
message
telling
me
to
authenticate
in
a
few
seconds
once
I
have
this
object,
I
just
put
it
into
the
authentication
provider
and
I
can
pass
all
of
that
to
my
graph
client
builder,
to
get
to
graphclient.
D
And
you
can
see
that
the
first
thing
that's
going
to
happen
after
my
application
is
built
and
started.
Is
that
I
will
get
a
message
here
telling
me
hey.
You
need
to
authenticate
and
because
again
we're
using
device
code
flow
which
is
very
well
suited
for
iot
applications
or
applications
living
on
devices
that
have
limited
user
input
capabilities.
It's
telling
me
hey,
go
to
microsoft.com
device,
login
enter
that
code
and
then
I'll
be
able
to
resume
what
I'm
doing.
So.
This
is
what
I'm
going
to
do.
I'm
going
to
go
to
microsoft.com
device.
D
D
This
is
a
really
important
if
you're
building
any
kind
of
ui
based
application,
either
for
java
or
for
android
or
if
you
have,
if
you
are
building
a
server
side
kind
of
application
web
server,
that's
calling
a
graph
behind
the
scenes
or
if
you
have
a
high
volume
of
call
that
you're
making
to
microsoft
graph.
Why?
Because
if
you're
blocking
on
the
main
thread,
the
ui
might
freeze
the
web,
server
won't
be
able
to
accept
new
calls
or
not,
as
many
new
calls,
that
it
could
accept
otherwise
and
so
on
and
so
forth.
D
By
doing
that,
asynchronously
you're
freeing
the
main
thread
to
do
other
things
like
handling
your
request
or
handling
updates
for
the
ui,
and
then
some
background
thread
will
actually
go
and
do
the
work
to
call
microsoft
graph,
get
a
response
back,
visualize,
the
response
and
so
on
and
so
forth.
Of
course,
you
still
have
the
synchronous
blocking
api
as
well.
So
that's
the
exact
same
call,
but
using
the
synchronous
api
that's
available
in
the
sdk
as
well.
So
you
can
see
that
it's
very
similar.
D
D
So,
if
I
go
to
the
next
breakpoint
you'll
see
that
we,
the
sdk,
still
has
object
and
and
models
for
the
different
entities
that
live
in
microsoft.
Graph
things
like
users,
messages
security
policies,
anything
of
at
least
in
microsoft,
graph
we
have
it
in
the
sdk,
so
that
gives
you
auto
completion
compile
time
validation.
D
D
The
next
thing
I
want
to
show
are
actually
two
things
here.
First,
are
the
fluent
api
support
for
odata
query
stream
parameters,
so
you
might
know
that
microsoft
graph
supports
odata
core
string
parameters
to
select
some
fields,
to
other
things,
to
count
things
to
limit
the
numbers
of
results
you
want
to
get
and
so
on
and
so
forth.
That
allows
you
to
tweak
very
specifically
the
request
you're
sending
to
microsoft
graph.
D
So
it
sends
you
back
a
very
specific
response
and
you
optimize
by
reducing
the
numbers
of
back
and
forth
calls
you're
making
by
reducing
the
payload
you're
getting
back.
So
all
of
that
will
participate
to
make
your
application
faster
and
provide
a
better
user
experience.
Previously,
we
did
not
have
a
data
core
string
parameter
support
in
the
fluent
api.
This
is
something
we've
added
recently
and
now,
instead
of
having
to
build
that
manually
in
the
url
or
add
manually
all
the
options.
D
Well,
you
can
just
use
the
phone
tpi
like
I've
done
here
to
say
all
right.
I
want
for
the
messages
for
the
current
users.
I
only
want
two
messages,
not
more
than
that.
I
want
to
order
them
by
the
most
recently
received.
I
want
only
to
select
the
subject
and
the
receive
date
time,
and
I
want
the
global
count
of
all
the
messages
in
the
inbox,
so
all
of
that
is
supported
supported
for
us.
D
So
if
I
go
to
the
next
breakpoint,
you
will
see
that
here
I
do
have
in
effect
two
messages
that
came
back
with
the
different
properties
like
the
subject,
the
id
and
the.
What
else
did
I
select
the
receive
date
time
and
you
can
see
also
that
vsd
case
report
and
it
already
supported
the
ability
to
iterate
over
pages
so
again,
because
I
only
selected
two
messages,
but
there
are
many
more
messages
in
the
inbox.
I
have
this
ability
to
keep
querying
graph
and
tell
graph
hey
give
me
the
next
results.
D
Give
me
even
the
next
results.
Give
me
the
next
results
and
vsdk
will
do
that
automatically
for
you
and
again.
Also
when
you
get
a
collection,
you
can
get
the
count
of
the
collection
that
leaves
behind.
With
that.
We
can
see
that
here
in
the
logs,
we
have
13
000
messages
in
this
inbox.
The
second
thing
I
wanted
to
show
here,
as
we're
talking
about
messages,
is
the
fact
that
we
now
rely
on
offset
date.
D
D
So
here,
for
example,
you
can
see
that
with
a
receipt
date
time,
I
added
an
hour
for
some
reason,
because
maybe
my
business
logic
requires
that
I
calculate
last
receive
date
time
plus
an
hour,
and
then
I
was
able
to
translate
it
to
the
local
date
time
of
my
machine
and
put
that
to
string,
and
you
can
see
that
in
in
the
logs
here
now.
The
next
thing
I
want
to
show
here
are.
D
Because
thank
you
for
the
question
so
because
this
is
a
message,
collection
page,
you
can
basically
using
the
dot
dot.
You
can
say
all
right
give
me
me
the
messages
bill,
request
and
dot
getting,
and
you
will
see
what
kind
of
object
you
get
back
now.
If
you
go
back,
if
you
navigate
to
that
collection
page,
you
can
perfectly
navigate
then
to
here
thanks
to
our
generic
type,
to
the
message
object.
D
D
What's
available
and
and
what
can
I
use
in
my
my
different
requests
and
to
navigate
between
those
it's
even
more
easy
than
it
used
to
be
with
with
v2?
Thank
you
for
the
for
the
question
now.
Moving
on
to
the
batches
we
have
improved
batch
support,
so
json
batches
in
microsoft
graph
are
an
ability
for
you
as
a
developer,
to
group
multiple
requests.
You
want
to
send
to
microsoft
graph
in
a
single
request
and
to
send
all
of
that
well
as
a
batch
to
microsoft
graph.
D
So
it
saves
a
lot
of
round
trips.
It
makes
your
app
more
performant
and
it's
generally
a
good
practice
to
do
those
sort
of
things,
so
we've
completely
cleaned
and
revamped
our
batching
api
in
the
sdk.
So
it's
much
cleaner.
So
you
can
see
that
now,
I'm
able
to
say
all
right,
I'm
gonna
use
the
graph
client
and
the
fluent
api,
like
I
did
just
before
here,
but
instead
of
executing
the
request
right
now,
I'm
going
to
build
a
batch
and
add
it
as
a
step
for
the
batch.
D
So
my
first
step
here
is
to
get
the
and
the
first
request
I
I'm
adding
to
the
batch
is
to
get
the
current
current
user
right
and
the
second
step,
I'm
adding
here
like
the
previous
thing
I
showed
you
earlier,
is
to
get
the
two
last
messages
and
again,
while
we
do
that,
we
also
keep
support
for
the
audita
fluent
api
and
all
the
nice
things
we
already
had
previously.
We
just
instead
of
executing
right
now.
We
just
put
it
in
a
batch
to
execute
it
later.
D
Once
we've
built
our
batch
with
all
the
different
requests,
we
want
to
execute
on
microsoft
graph.
Well,
it's
time
to
execute
the
batch
itself
and
again
this
is
much
easier
than
it
used
to
be.
You
can
do
graphclient.batch.bill,
request,
post
the
batch
and
pass
the
the
batch
that
you
you
you
just
you
just
built
so
that
will
effectively
get
the
batch
with
all
its
requests.
Send
it
to
microsoft.
Graph
and
crossover
will
process
it.
Give
you
the
response
back
once
you
get
the
response.
D
Well,
you
can
get
each
individual
step
using
the
step
id
you
get.
You
got
when
you
added
the
the
step
into
the
batch
and
you
can
decilize
it
automatically
using
our
native
digitalizers
and
all
the
infrastructure
we
have
natively
again.
This
is
much
easier
than
it
used
to
be
previously
and
get
get
the
user
back
so
here
you'll
see
that
if
I
move
with
my
breakpoint
you'll
see
that
here
I
got
the
username
from
the
batch
request
from
here
automatically
and
with
that
those
are
all
the
new
capabilities.
D
I
wanted
to
show
today
to
you
with
a
new
java,
v3
sdk,
and
also
it's
also
our
sdk
for
for
android.
Again,
all
of
that
relies
on
the
nice
things
we
get
from
azure
identity
and
m
style
from
an
authentication
and
authorization
point
of
view,
and
it
makes
querying
microsoft
graph
from
a
java
or
an
android
application,
much
easier.
You
don't
have
to
craft
requests
manually
and
so
on
and
so
forth.
I
will
hand
it
back
to
mesa
to
close
this
part.
C
E
You
myself,
vincent
and
team,
thank
you
for
sharing
the
graph
sdks.
We're
super
excited
to
try
it
out.
Thank
you
so
much
everyone.
Thank
you
again.
I
think.
If
you
have
any
follow-up
questions
you
can
just
reach
out,
I
think,
to
winston
and
myself
and
also
access
the
libraries
that
are
publicly
available
on
github.
Thank
you
so
much.