Azure KeyVaultClient：使用Java中的证书进行身份验证

Question

我正尝试从pfx证书中的Azure Java SDK创建KeyVaultClient对象。我发现了一个关于如何在C＃中做到这一点的清晰文档，但必须知道如何在Java中执行此操作。

我能够从用户帐户keystore获得Windows证书，但我真的不知道要传递给KeyVaultClient构造函数的内容。它看起来像接受TokenCredentials类型的对象，但是我找不到任何有关如何实际构建其中一个（需要“标记”和“方案”）的文档。

Answer 1

看来我靠近有一些工作定义这个类：

class WindowsStoreCertificateCredentials(clientId: String, certificate: X509Certificate, privateKey: PrivateKey) extends KeyVaultCredentials { 

def getAuthResult(authority: String, resource: String): AuthenticationResult = {  
    val service = Executors.newFixedThreadPool(1) 
    val context = new AuthenticationContext(authority, false, service) 

    val certificateCredentials = AsymmetricKeyCredential.create(clientId, privateKey, certificate) 
    val authResultFuture = context.acquireToken(resource, certificateCredentials, null) 
    authResultFuture.get 
} 

override def doAuthenticate (authority: String, resource: String, scope: String): String = { 
    getAuthResult(authority, resource).getAccessToken 
} 

}

，并试图用它获得使用java.security.KeyStore中的证书X509Certificate对象和私钥后：

val client = new KeyVaultClient(new WindowsStoreCertificateCredentials(
    id, privateKey, certificate,)) 

val test = client.getSecret("https:/...") 

不幸的是，引发一个异常：

sun.security.mscapi.RSAPrivateKey cannot be cast to java.security.interfaces.RSAPrivateKey java.lang.ClassCastException: sun.security.mscapi.RSAPrivateKey cannot be cast to java.security.interfaces.RSAPrivateKey 

我在GitHub上AzureAD打开一个问题/蔚的ActiveDirectory库换java和建议pull请求解决它，未完待续......

编辑：这是现在固定在AzureAD的版本1.2.0/azure-activedirectory-library-for-java。

Answer 2

这听起来像你想知道如何使用Azure的SDK的Java创建通过与所需的参数ServiceClientCredentials credentials构造方法的KeyVaultClient对象，作为javadoc说。

这是我的示例代码。

import com.microsoft.azure.AzureEnvironment; 
import com.microsoft.azure.CloudException; 
import com.microsoft.azure.credentials.ApplicationTokenCredentials; 
import com.microsoft.azure.keyvault.KeyVaultClient; 
import com.microsoft.azure.management.Azure; 
import com.microsoft.rest.credentials.ServiceClientCredentials; 

String clientId = "xxxx"; 
String domain = "xxxx"; // The same as tenant_id 
String secret = "xxxx"; // The same as client_secret or keys 
AzureEnvironment environment = AzureEnvironment.AZURE; 
ServiceClientCredentials credentials = new ApplicationTokenCredentials(clientId, domain, secret, environment); 
// New a KeyVaultClient object 
KeyVaultClient kvClient = new KeyValutClient(credentials); 

为参照，你可以参考在Azure官方document得到的参数clientId，domain & secret在Azure管理门户。为天青的Java SDK的API的更多细节，请查看javadocs