com.microsoft.aad.msal4j

Interface IConfidentialClientApplication

All Known Implementing Classes:

ConfidentialClientApplication

public interface IConfidentialClientApplication

Interface representing a confidential client application (Web App, Web API, Daemon App). Confidential client applications are trusted to safely store application secrets, and therefore can be used to acquire tokens in then name of either the application or an user. For details see https://aka.ms/msal4jclientapplications

Field Summary

Fields

Modifier and Type	Field and Description
static String	DEFAULT_AUTHORITY

Method Summary

Modifier and Type	Method and Description
CompletableFuture<IAuthenticationResult>	acquireToken(AuthorizationCodeParameters parameters) Acquires security token from the authority using an authorization code previously received.
CompletableFuture<IAuthenticationResult>	acquireToken(ClientCredentialParameters parameters) Acquires tokens from the authority configured in the application, for the confidential client itself.
CompletableFuture<IAuthenticationResult>	acquireToken(OnBehalfOfParameters parameters) Acquires an access token for this application (usually a Web API) from the authority configured in the application, in order to access another downstream protected Web API on behalf of a user using the On-Behalf-Of flow.
CompletableFuture<IAuthenticationResult>	acquireToken(RefreshTokenParameters parameters) Acquires a security token from the authority using a refresh token previously received.
CompletableFuture<IAuthenticationResult>	acquireTokenSilently(SilentParameters parameters) Returns tokens from cache if present and not expired or acquires new tokens from the authority by using the refresh token present in cache.
String	authority() Gets the authority URL for this application.
String	clientId() Gets the client ID (application ID) for this application.
String	correlationId() Gets the correlation ID used for tracing requests through the authentication system.
CompletableFuture<Set<IAccount>>	getAccounts() Returns accounts in the cache
URL	getAuthorizationRequestUrl(AuthorizationRequestUrlParameters parameters) Computes the URL of the authorization request letting the user sign-in and consent to the application.
IHttpClient	httpClient() Gets the HTTP client used by the application for all HTTP requests.
boolean	logPii() Gets whether personally identifiable information (PII) is included in log messages.
Proxy	proxy() Gets the proxy configuration used by the application for network communication.
CompletableFuture	removeAccount(IAccount account) Removes IAccount from the cache
boolean	sendX5c()
SSLSocketFactory	sslSocketFactory() Gets the SSL socket factory used by the application for secure network communication.
boolean	validateAuthority() Gets whether the authority URL should be validated against a list of known authorities.

Field Detail

DEFAULT_AUTHORITY

static final String DEFAULT_AUTHORITY

See Also:

Constant Field Values

Method Detail

sendX5c

boolean sendX5c()

Returns:

a boolean value which determines whether x5c claim (public key of the certificate) will be sent to the STS.

acquireToken

CompletableFuture<IAuthenticationResult> acquireToken(ClientCredentialParameters parameters)

Acquires tokens from the authority configured in the application, for the confidential client itself. It will by default attempt to get tokens from the token cache. If no tokens are found, it falls back to acquiring them via client credentials from the STS

Parameters:

parameters - instance of ClientCredentialParameters

Returns:

CompletableFuture containing an IAuthenticationResult

acquireToken

CompletableFuture<IAuthenticationResult> acquireToken(OnBehalfOfParameters parameters)

Acquires an access token for this application (usually a Web API) from the authority configured in the application, in order to access another downstream protected Web API on behalf of a user using the On-Behalf-Of flow. It will by default attempt to get tokens from the token cache. This confidential client application was itself called with an acces token which is provided in the UserAssertion field of OnBehalfOfParameters.

When serializing/deserializing the in-memory token cache to permanent storage, there should be a token cache per incoming access token, where the hash of the incoming access token can be used as the token cache key. Access tokens are usually only valid for a 1 hour period of time, and a new access token in the UserAssertion means there will be a new token cache and new token cache key. To avoid your permanent storage from being filled with expired token caches, an eviction policy should be set. For example, a token cache that is more than a couple of hours old can be deemed expired and therefore evicted from the serialized token cache.

Parameters:

parameters - instance of OnBehalfOfParameters

Returns:

CompletableFuture containing an IAuthenticationResult

clientId

String clientId()

Gets the client ID (application ID) for this application.

Returns:

Client ID (Application ID) of the application as registered in the application registration portal (portal.azure.com) and as passed in the constructor of the application

authority

String authority()

Gets the authority URL for this application.

Returns:

URL of the authority, or security token service (STS) from which MSAL will acquire security tokens. Default value is IApplicationBase.DEFAULT_AUTHORITY

validateAuthority

boolean validateAuthority()

Gets whether the authority URL should be validated against a list of known authorities.

Returns:

A boolean value which determines whether the authority needs to be verified against a list of known authorities. When true, MSAL will validate the authority against a list of well-known authorities. Set to false only for development/testing with custom authority URLs.

getAuthorizationRequestUrl

URL getAuthorizationRequestUrl(AuthorizationRequestUrlParameters parameters)

Computes the URL of the authorization request letting the user sign-in and consent to the application. The URL target the /authorize endpoint of the authority configured in the application object.

Once the user successfully authenticates, the response should contain an authorization code, which can then be passed in to AbstractClientApplicationBase.acquireToken(AuthorizationCodeParameters) to be exchanged for a token.

Parameters:

parameters - AuthorizationRequestUrlParameters containing the details needed to create the authorization URL, such as scopes, response type, and redirect URI

Returns:

URL of the authorization endpoint where the user can sign-in and consent to the application

acquireToken

CompletableFuture<IAuthenticationResult> acquireToken(AuthorizationCodeParameters parameters)

Acquires security token from the authority using an authorization code previously received.

This is typically used as the second step in an authorization code flow, after the user has authenticated and provided consent at the authorization endpoint, resulting in an authorization code.

Parameters:

parameters - AuthorizationCodeParameters containing the authorization code and other information required to exchange the code for tokens

Returns:

A CompletableFuture object representing the IAuthenticationResult of the call, which contains the requested tokens and account information

acquireToken

CompletableFuture<IAuthenticationResult> acquireToken(RefreshTokenParameters parameters)

Acquires a security token from the authority using a refresh token previously received. Can be used in migration to MSAL from ADAL, and in various integration scenarios where you have a refresh token available.

Parameters:

parameters - RefreshTokenParameters

Returns:

A CompletableFuture object representing the IAuthenticationResult of the call.

acquireTokenSilently

CompletableFuture<IAuthenticationResult> acquireTokenSilently(SilentParameters parameters)
                                                       throws MalformedURLException

Returns tokens from cache if present and not expired or acquires new tokens from the authority by using the refresh token present in cache.

Parameters:

parameters - instance of SilentParameters

Returns:

A CompletableFuture object representing the IAuthenticationResult of the call.

Throws:

MalformedURLException - if authorityUrl from parameters is malformed URL

getAccounts

CompletableFuture<Set<IAccount>> getAccounts()

Returns accounts in the cache

Returns:

set of unique accounts from cache which can be used for silent acquire token call

removeAccount

CompletableFuture removeAccount(IAccount account)

Removes IAccount from the cache

Parameters:

account - instance of Account to be removed from cache

Returns:

CompletableFuture object representing account removal task.

logPii

boolean logPii()

Gets whether personally identifiable information (PII) is included in log messages.

Returns:

A boolean value which determines whether PII (personally identifiable information) will be included in log messages. When true, PII will be logged; when false, PII will be masked or omitted from logs.

correlationId

String correlationId()

Gets the correlation ID used for tracing requests through the authentication system.

Returns:

Correlation ID which is used for diagnostics purposes and is attached to token service requests. The default value is a random UUID.

httpClient

IHttpClient httpClient()

Gets the HTTP client used by the application for all HTTP requests.

Returns:

Instance of IHttpClient used by the application for network communication with the Microsoft identity platform.

proxy

Proxy proxy()

Gets the proxy configuration used by the application for network communication.

Returns:

Proxy used by the application for all network communication. Returns null if no proxy is configured.

sslSocketFactory

SSLSocketFactory sslSocketFactory()

Gets the SSL socket factory used by the application for secure network communication.

Returns:

SSLSocketFactory used by the application for all secure network communication. Returns null if no custom SSL socket factory is configured.