RBAC for User Principals in Java

Somansh Reddy 136 Reputation points
2020-07-25T11:09:35.113+00:00

I haven't understood how the authentication and authorization works for User Principals. I want to create a Client in Java to use for interactions with all the SDK APIs.

I want to make calls at a User Principal level. This article https://github.com/Azure/azure-sdk-for-java/blob/master/sdk/identity/azure-identity/README.md#authenticating-a-user-account-with-username-and-password

indicates that we can achieve this using a username and password. But I have seen some articles that discourage this approach. How exactly is User Principal RBAC implemented in Java?

I think the client id, tenant id and client secret are at a storage account level. What are the exact credentials that make it USER specific?

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
672 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,566 questions
0 comments
Accepted answer
  1. soumi-MSFT 11,716 Reputation points Microsoft Employee
    2020-07-27T07:21:19.577+00:00

    @Somansh Reddy , Thank you for reaching out. In a single line answer, RBAC is not for Azure AD but for Azure Resources, and hence with you use any programming language and implement an Authentication Library like MSAL etc, it has nothing to do with RBAC roles.

    Now, let's walk you through few points here:

    1. RBAC: It stands for Resource-Based Access Control, by this we mean, whenever you are accessing or working with any Azure Resouces like (VMs, SQL DB Servers, VNETs, Storage etc), you would need to provide certain access-control permissions either on the subscription level or on the resource level and that's what is referred to as RBAC (in portal you would find it as IAM or Access-Control)
    2. Directory Roles: These roles are found under Azure AD and these roles are assigned to users, so that they are able to manage the Azure AD components, like managing the applications registered in AAD, or managing the groups, managing the Conditional Access Policies, etc.
    3. API Permissions(Delegated and Application Permissions): These permissions are the ones that you provide in the Application Registration that you made in AAD and for the API that you added in that application registration, for eg: on Microsoft Graph API. Now these permissions that you have applied on the API, would be added in the Access_tokens when a request is sent to AAD for accessing that API using the registered application in AAD. AAD pushes these permissions based on the ones you mentioned in the request (to AAD) and then issue you the token. Once the token is issued, you use your application to call the API and send that access_token issued by AAD along with that api call. The API-Backend receives the token, validates it and checks for the permissions mentioned in it. If the permissions are correct, the API-Backend authorizes your access and provides you the required details.

    The article you mentioned https://github.com/Azure/azure-sdk-for-java/blob/master/sdk/identity/azure-identity/README.md#authenticating-a-user-account-with-username-and-password, I checked that and it doesn't need RBAC roles to be configured anywhere. Since it uses UserName-Password hence the OAuth flow it is using is the Resource-Owner-Password Grant Flow

    The client ID, client Secret and tenant ID are specific to the Application Registration that you have to perform in AAD. Do take a look at the details of Resource-Owner-Password Grant flow as mentioned in this article: https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc

    Hope this helps.

    Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as Answer; if the above response helped in answering your query.

    1 person found this answer helpful.

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. soumi-MSFT 11,716 Reputation points Microsoft Employee
    2020-08-03T07:04:43.217+00:00

    @Somansh Reddy , Thank you for sharing the details. So, let's divide the problem statement into two major steps:

    1. Getting the user authentication done so that an access-token can be issued to the user by AAD with proper permission.
      For this step, to get the user authentication done, we need to use the authorization-code grant flow of OAuth.
      Before getting the user authentication done, make sure that proper "delegated permissions" are given to the storage apis in the App registration in AAD.
      After the authentication is done, and we receive the token issued by AAD, make sure the token has the right storage permissions listed in the token under the "scp" key of the decoded jwt access-token.
    2. Once we get the token with proper permissions to access the storage, we call the storage apis using this token.

    Hope this helps.

    Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as Answer; if the above response helped in answering your quer

    1 person found this answer helpful.
  2. Somansh Reddy 136 Reputation points
    2020-08-13T11:27:25.543+00:00

    Is it possible to assign permissions to my application itself rather than to users using my application?

    Basically, if I register my application with Azure AD, I need my application to have the permissions to access the storage APIs. The authentication can be for my entire application itself