Search code examples
javaazureazure-active-directory

Azure oAuth token retrieval with user managed identity

I am new to Azure. I have an app service and a system managed and an user managed identity. I want to use the rest endpoint to get the access tokens. Based on a config flag, I want to use either

  1. Use the User Managed Identity to get the access tokens. or
  2. Use the system managed identity to get the access tokens.

Since I am new, I am not sure about which endpoint to call. Most importantly, I want to under as to how I can request the AAD to use User Managed Identity over the system managed.

Solution

  • I tried to reproduce the same in my environment and got below results:

    I have one App service where I enabled system assigned managed identity like below:

    enter image description here

    Now, Open Kudu by selecting Advanced Tools in your App Service like below:

    enter image description here

    In new tab, Kudo will be opened where you need to select PowerShell under Debug console like below:

    enter image description here

    Now, run the below PowerShell script to get access token using System-assigned managed identity:

    $resourceURI = "https://storage.azure.com"
$tokenAuthURI = $env:IDENTITY_ENDPOINT + "?resource=$resourceURI&api-version=2019-08-01"
$tokenResponse = Invoke-RestMethod -Method Get -Headers @{"X-IDENTITY-HEADER"="$env:IDENTITY_HEADER"} -Uri $tokenAuthURI
$accessToken = $tokenResponse.access_token

    Response:

    enter image description here

    You can run $accessToken to print the token like below:

    enter image description here

    I added one user managed identity to the App Service like below:

    enter image description here

    To get access token using User assigned Managed Identity, you need to include one of the optional parameters like client_id or principal_id in the script.

    You can find values of these parameters from your managed identity:

    enter image description here

    In my case, I included client_id in PowerShell script to get token using User assigned managed identity like below:

    $resourceURI = "https://storage.azure.com/"
$client_id = "d5845093-6622-4827-ad6a-xxxxxxxxxx"
$tokenAuthURI = $env:IDENTITY_ENDPOINT + "?resource=$resourceURI&client_id=$client_id&api-version=2019-08-01"
$tokenResponse = Invoke-RestMethod -Method Get -Headers @{"X-IDENTITY-HEADER"="$env:IDENTITY_HEADER"} -Uri $tokenAuthURI
$accessToken = $tokenResponse.access_token

    Response:

    enter image description here

    You can run $accessToken to print the token like below:

    enter image description here

    Based on your requirement, you can change the value of $resourceURI parameter to https://graph.microsoft.com, https://vault.azure.net or https://management.azure.com etc...

    Including one of the optional parameters is enough to get access token from User Managed Identity over the system managed.

    Reference: Managed identities - Azure App Service | Microsoft