Skip to content

Latest commit

 

History

History
95 lines (88 loc) · 5.72 KB

README.md

File metadata and controls

95 lines (88 loc) · 5.72 KB
Raw

Use azure-security-keyvault-jca.jar via Command Line in client side

Key concepts

This sample illustrates how to use azure-security-keyvault-jca.jar via command line in client side.

Getting started

  • This sample contains a simple web client function.

Environment

jdk 11.0.12 or above

Run Spring Boot web server with azure-security-keyvault-jca.jar via command line.

  1. Start the server side sample. Please refer to server side tutorial.
  2. Open terminal and enter the folder where the pom.xml is and run mvn package. In the target folder there is a run-with-command-line-client-1.0.0.jar generated.
  3. Get a copy of the JCA configuration file.
    • Linux: /lib/security/java.security
    • MacOS Big Sur: /conf/security/java.security
    • Windows: \conf\security\java.security
  4. Edit your copy of the JCA configuration file. Add a new item: KeyVaultJcaProvider 
    security.provider.1=SUN
security.provider.2=SunRsaSign
security.provider.3=SunEC
security.provider.4=SunJSSE
security.provider.5=SunJCE
security.provider.6=SunJGSS
security.provider.7=SunSASL
security.provider.8=XMLDSig
security.provider.9=SunPCSC
security.provider.10=JdkLDAP
security.provider.11=JdkSASL
security.provider.12=Apple
security.provider.13=SunPKCS11
# Next line is the new added item.
security.provider.14=com.azure.security.keyvault.jca.KeyVaultJcaProvider
  5. Get the azure-security-keyvault-jca.jar. You can download the latest published jar from maven repository azure-security-keyvault-jca. When this document is written, the latest jar is azure-security-keyvault-jca-2.7.0.jar
  6. Make a directory, for example, sample_client. Then put the 3 files into sample_client folder
    • java.security
    • run-with-command-line-client-side-1.0.0.jar
    • azure-security-keyvault-jca-2.7.0.jar
  7. Create the key vault and certificates, please refer to create key vault and certificates. Create service principal and add a secret, please refer to register app with Microsoft Entra ID.
  8. Create a new Access policy for the service principal created in the previous step, including the Get and List permissions of the Secret permissions, and the Get and List permissions of the Certificate permissions.
  9. Replace properties <yourAzureKeyVaultUri>, <yourTenantID>, <youClientID>, <yourSecretValue> with your created resources in the following command, open terminal and enter the directory sample_client, run the changed command: 
    java \
--module-path ./azure-security-keyvault-jca-2.7.0.jar \
--add-modules com.azure.security.keyvault.jca \
-Dsecurity.overridePropertiesFile=true \
-Djava.security.properties==./java.security \
-Djavax.net.ssl.trustStoreType=AzureKeyVault \
-Dazure.keyvault.uri=<yourKeyVaultURI> \
-Dazure.keyvault.tenant-id=<yourTenantID> \
-Dazure.keyvault.client-id=<yourClientID> \
-Dazure.keyvault.client-secret=<yourSecretValue> \
-jar run-with-command-line-client-side-1.0.0.jar
    If you have run the server side with client authentication needed, please use the following command instead of the above to run the client side: 
    java \
--module-path ./azure-security-keyvault-jca-2.7.0.jar \
--add-modules com.azure.security.keyvault.jca \
-Dsecurity.overridePropertiesFile=true \
-Djava.security.properties==./java.security \
-Djavax.net.ssl.trustStoreType=AzureKeyVault \
-Djavax.net.ssl.keyStoreType=AzureKeyVault \
-Dazure.keyvault.uri=<yourKeyVaultURI> \
-Dazure.keyvault.tenant-id=<yourTenantID> \
-Dazure.keyvault.client-id=<yourClientID> \
-Dazure.keyvault.client-secret=<yourSecretValue> \
-jar run-with-command-line-client-side-1.0.0.jar
  10. Check the output. The client will be started and connect to the server side after a while, you will see "Hello World!".
  11. (Optional) You can also use the KeyVaultKeyStore with local certificates.
    • For example, there are some well known CAs. You can put them into a folder, then configure the system property azure.cert-path.well-known=<yourFolderPath>. The certificates in this folder will be loaded by KeyVaultKeystore. If you don't configure such a property, the default well-known path will be /etc/certs/well-known/.
    • Besides, the well-known path, you can also put your customized certificates into another folder specified by azure.cert-path.custom=<yourCustomPath>, by default, the custom path is /etc/certs/custom/.
    • You can also put certificates under the class path, build a folder named keyvault and configure it under the class path, then all the certificates in this folder will be loaded by key vault keystore.

Deploy to Azure Spring Apps

Now that you have the Spring Boot application running locally, it's time to move it to production. Azure Spring Apps makes it easy to deploy Spring Boot applications to Azure without any code changes. The service manages the infrastructure of Spring applications so developers can focus on their code. Azure Spring Apps provides lifecycle management using comprehensive monitoring and diagnostics, configuration management, service discovery, CI/CD integration, blue-green deployments, and more. To deploy your application to Azure Spring Apps, see Deploy your first application to Azure Spring Apps.