com.microsoft.aad.msal4j

Interface IConfidentialClientApplication

All Known Implementing Classes:

ConfidentialClientApplication

public interface IConfidentialClientApplication

Interface representing a confidential client application (Web App, Web API, Daemon App). Confidential client applications are trusted to safely store application secrets, and therefore can be used to acquire tokens in then name of either the application or an user. For details see https://aka.ms/msal4jclientapplications

Field Summary

Fields

Modifier and Type	Field and Description
static String	DEFAULT_AUTHORITY

Method Summary

Modifier and Type	Method and Description
CompletableFuture<IAuthenticationResult>	acquireToken(AuthorizationCodeParameters parameters) Acquires security token from the authority using an authorization code previously received.
CompletableFuture<IAuthenticationResult>	acquireToken(ClientCredentialParameters parameters) Acquires tokens from the authority configured in the application, for the confidential client itself.
CompletableFuture<IAuthenticationResult>	acquireToken(OnBehalfOfParameters parameters) Acquires an access token for this application (usually a Web API) from the authority configured in the application, in order to access another downstream protected Web API on behalf of a user using the On-Behalf-Of flow.
CompletableFuture<IAuthenticationResult>	acquireToken(RefreshTokenParameters parameters) Acquires a security token from the authority using a refresh token previously received.
CompletableFuture<IAuthenticationResult>	acquireTokenSilently(SilentParameters parameters) Returns tokens from cache if present and not expired or acquires new tokens from the authority by using the refresh token present in cache.
String	authority()
String	clientId()
String	correlationId()
CompletableFuture<Set<IAccount>>	getAccounts() Returns accounts in the cache
URL	getAuthorizationRequestUrl(AuthorizationRequestUrlParameters parameters) Computes the URL of the authorization request letting the user sign-in and consent to the application.
boolean	logPii()
Proxy	proxy()
CompletableFuture	removeAccount(IAccount account) Removes IAccount from the cache
boolean	sendX5c()
SSLSocketFactory	sslSocketFactory()
ITokenCache	tokenCache()
boolean	validateAuthority()

Field Detail

DEFAULT_AUTHORITY

static final String DEFAULT_AUTHORITY

See Also:

Constant Field Values

Method Detail

sendX5c

boolean sendX5c()

Returns:

a boolean value which determines whether x5c claim (public key of the certificate) will be sent to the STS.

acquireToken

CompletableFuture<IAuthenticationResult> acquireToken(ClientCredentialParameters parameters)

Acquires tokens from the authority configured in the application, for the confidential client itself. It will by default attempt to get tokens from the token cache. If no tokens are found, it falls back to acquiring them via client credentials from the STS

Parameters:

parameters - instance of ClientCredentialParameters

Returns:

CompletableFuture containing an IAuthenticationResult

acquireToken

CompletableFuture<IAuthenticationResult> acquireToken(OnBehalfOfParameters parameters)

Acquires an access token for this application (usually a Web API) from the authority configured in the application, in order to access another downstream protected Web API on behalf of a user using the On-Behalf-Of flow. It will by default attempt to get tokens from the token cache. This confidential client application was itself called with an acces token which is provided in the UserAssertion field of OnBehalfOfParameters.

When serializing/deserializing the in-memory token cache to permanent storage, there should be a token cache per incoming access token, where the hash of the incoming access token can be used as the token cache key. Access tokens are usually only valid for a 1 hour period of time, and a new access token in the UserAssertion means there will be a new token cache and new token cache key. To avoid your permanent storage from being filled with expired token caches, an eviction policy should be set. For example, a token cache that is more than a couple of hours old can be deemed expired and therefore evicted from the serialized token cache.

Parameters:

parameters - instance of OnBehalfOfParameters

Returns:

CompletableFuture containing an IAuthenticationResult

clientId

String clientId()

Returns:

Client ID (Application ID) of the application as registered in the application registration portal (portal.azure.com) and as passed in the constructor of the application

authority

String authority()

Returns:

URL of the authority, or security token service (STS) from which MSAL will acquire security tokens. Default value is IClientApplicationBase.DEFAULT_AUTHORITY

validateAuthority

boolean validateAuthority()

Returns:

a boolean value which determines whether the authority needs to be verified against a list of known authorities.

correlationId

String correlationId()

Returns:

Correlation Id which is used for diagnostics purposes, is attached to token service requests Default value is random UUID

logPii

boolean logPii()

Returns:

a boolean value which determines whether Pii (personally identifiable information) will be logged in

proxy

Proxy proxy()

Returns:

proxy used by the application for all network communication.

sslSocketFactory

SSLSocketFactory sslSocketFactory()

Returns:

SSLSocketFactory used by the application for all network communication.

tokenCache

ITokenCache tokenCache()

Returns:

Cache holding access tokens, refresh tokens, id tokens. It is maintained and used silently if needed when calling IClientApplicationBase.acquireTokenSilently(SilentParameters)

getAuthorizationRequestUrl

URL getAuthorizationRequestUrl(AuthorizationRequestUrlParameters parameters)

Computes the URL of the authorization request letting the user sign-in and consent to the application. The URL target the /authorize endpoint of the authority configured in the application object.

Once the user successfully authenticates, the response should contain an authorization code, which can then be passed in toAbstractClientApplicationBase.acquireToken(AuthorizationCodeParameters) to be exchanged for a token

Parameters:

parameters - AuthorizationRequestUrlParameters

Returns:

url of the authorization endpoint where the user can sign-in and consent to the application.

acquireToken

CompletableFuture<IAuthenticationResult> acquireToken(AuthorizationCodeParameters parameters)

Acquires security token from the authority using an authorization code previously received.

Parameters:

parameters - AuthorizationCodeParameters

Returns:

A CompletableFuture object representing the IAuthenticationResult of the call.

acquireToken

CompletableFuture<IAuthenticationResult> acquireToken(RefreshTokenParameters parameters)

Acquires a security token from the authority using a refresh token previously received. Can be used in migration to MSAL from ADAL, and in various integration scenarios where you have a refresh token available.

Parameters:

parameters - RefreshTokenParameters

Returns:

A CompletableFuture object representing the IAuthenticationResult of the call.

acquireTokenSilently

CompletableFuture<IAuthenticationResult> acquireTokenSilently(SilentParameters parameters)
                                                       throws MalformedURLException

Returns tokens from cache if present and not expired or acquires new tokens from the authority by using the refresh token present in cache.

Parameters:

parameters - instance of SilentParameters

Returns:

A CompletableFuture object representing the IAuthenticationResult of the call.

Throws:

MalformedURLException - if authorityUrl from parameters is malformed URL

getAccounts

CompletableFuture<Set<IAccount>> getAccounts()

Returns accounts in the cache

Returns:

set of unique accounts from cache which can be used for silent acquire token call

removeAccount

CompletableFuture removeAccount(IAccount account)

Removes IAccount from the cache

Parameters:

account - instance of Account to be removed from cache

Returns:

CompletableFuture object representing account removal task.