|
| 1 | +--- |
| 2 | +title: 'Tutorial: Access data with managed identity in Java' |
| 3 | +description: Secure Azure Database for PostgreSQL connectivity with managed identity from a sample Java Tomcat app, and apply it to other Azure services. |
| 4 | +ms.devlang: java |
| 5 | +ms.topic: tutorial |
| 6 | +ms.date: 09/26/2022 |
| 7 | +author: shizn |
| 8 | +ms.author: xshi |
| 9 | +--- |
| 10 | + |
| 11 | +# Tutorial: Connect to a PostgreSQL Database from Java Tomcat App Service without secrets using a managed identity |
| 12 | + |
| 13 | +[Azure App Service](overview.md) provides a highly scalable, self-patching web hosting service in Azure. It also provides a [managed identity](overview-managed-identity.md) for your app, which is a turn-key solution for securing access to [Azure Database for PostgreSQL](/azure/postgresql/) and other Azure services. Managed identities in App Service make your app more secure by eliminating secrets from your app, such as credentials in the environment variables. In this tutorial, you will learn how to: |
| 14 | + |
| 15 | +> [!div class="checklist"] |
| 16 | +> * Create a PostgreSQL database. |
| 17 | +> * Deploy the sample app to Azure App Service on Tomcat using WAR packaging. |
| 18 | +> * Configure a Spring Boot web application to use Azure AD authentication with PostgreSQL Database. |
| 19 | +> * Connect to PostgreSQL Database with Managed Identity using Service Connector. |
| 20 | +
|
| 21 | +[!INCLUDE [quickstarts-free-trial-note](../../includes/quickstarts-free-trial-note.md)] |
| 22 | + |
| 23 | +## Prerequisites |
| 24 | + |
| 25 | +* [Git](https://git-scm.com/) |
| 26 | +* [Java JDK](/azure/developer/java/fundamentals/java-support-on-azure) |
| 27 | +* [Maven](https://maven.apache.org) |
| 28 | +* [Azure CLI](/cli/azure/overview). This quickstart requires that you are running the latest [edge build of Azure CLI](https://github.com/Azure/azure-cli/blob/dev/doc/try_new_features_before_release.md). [Download and install the edge builds](https://github.com/Azure/azure-cli#edge-builds) for your platform. |
| 29 | + |
| 30 | +## Clone the sample app and prepare the repo |
| 31 | + |
| 32 | +Run the following commands in your terminal to clone the sample repo and set up the sample app environment. |
| 33 | + |
| 34 | +```bash |
| 35 | +git clone https://github.com/Azure-Samples/Passwordless-Connections-for-Java-Apps |
| 36 | +cd Passwordless-Connections-for-Java-Apps/Tomcat/checklist/ |
| 37 | +``` |
| 38 | + |
| 39 | +## Create an Azure Postgres DB |
| 40 | + |
| 41 | +Follow these steps to create an Azure Database for Postgres Single Server in your subscription. The Spring Boot app will connect to this database and store its data when running, persisting the application state no matter where you run the application. |
| 42 | + |
| 43 | +1. Sign into the Azure CLI, and optionally set your subscription if you have more than one connected to your login credentials. |
| 44 | + |
| 45 | + ```azurecli-interactive |
| 46 | + az login |
| 47 | + az account set --subscription <subscription-ID> |
| 48 | + ``` |
| 49 | + |
| 50 | +1. Create an Azure Resource Group, noting the resource group name. |
| 51 | + |
| 52 | + ```azurecli-interactive |
| 53 | + RESOURCE_GROUP=<resource-group-name> |
| 54 | + LOCATION=eastus |
| 55 | +
|
| 56 | + az group create --name $RESOURCE_GROUP --location $LOCATION |
| 57 | + ``` |
| 58 | + |
| 59 | +1. Create an Azure Postgres Database server. The server is created with an administrator account, but it won't be used as we'll use the Azure Active Directory (Azure AD) admin account to perform administrative tasks. |
| 60 | + |
| 61 | + ```azurecli-interactive |
| 62 | + POSTGRESQL_ADMIN_USER=azureuser |
| 63 | + # PostgreSQL admin access rights won't be used as Azure AD authentication is leveraged to administer the database. |
| 64 | + POSTGRESQL_ADMIN_PASSWORD=<admin-password> |
| 65 | + POSTGRESQL_HOST=<postgresql-host-name> |
| 66 | +
|
| 67 | + # Create a PostgreSQL server. |
| 68 | + az postgres server create \ |
| 69 | + --resource-group $RESOURCE_GROUP \ |
| 70 | + --name $POSTGRESQL_HOST \ |
| 71 | + --location $LOCATION \ |
| 72 | + --admin-user $POSTGRESQL_ADMIN_USER \ |
| 73 | + --admin-password $POSTGRESQL_ADMIN_PASSWORD \ |
| 74 | + --public-network-access 0.0.0.0 \ |
| 75 | + --sku-name B_Gen5_1 |
| 76 | + ``` |
| 77 | + |
| 78 | +1. Create a database for the application. |
| 79 | + |
| 80 | + ```azurecli-interactive |
| 81 | + DATABASE_NAME=checklist |
| 82 | +
|
| 83 | + az postgres db create \ |
| 84 | + --resource-group $RESOURCE_GROUP \ |
| 85 | + --server-name $POSTGRESQL_HOST \ |
| 86 | + --name $DATABASE_NAME |
| 87 | + ``` |
| 88 | + |
| 89 | +## Deploy the application to App Service |
| 90 | + |
| 91 | +Follow these steps to build a WAR file and deploy to Azure App Service on Tomcat using a WAR packaging. |
| 92 | + |
| 93 | +The changes you made in *application.properties* also apply to the managed identity, so the only thing to do is to remove the existing application settings in App Service. |
| 94 | + |
| 95 | +1. The sample app contains a *pom-war.xml* file that can generate the WAR file. Run the following command to build the app. |
| 96 | + |
| 97 | + ```bash |
| 98 | + mvn clean package -f pom-war.xml |
| 99 | + ``` |
| 100 | + |
| 101 | +1. Create an Azure App Service resource on Linux using Tomcat 9.0. |
| 102 | + |
| 103 | + ```azurecli-interactive |
| 104 | + # Create an App Service plan |
| 105 | + az appservice plan create \ |
| 106 | + --resource-group $RESOURCE_GROUP \ |
| 107 | + --name $APPSERVICE_PLAN \ |
| 108 | + --location $LOCATION \ |
| 109 | + --sku B1 \ |
| 110 | + --is-linux |
| 111 | +
|
| 112 | + # Create an App Service resource. |
| 113 | + az webapp create \ |
| 114 | + --resource-group $RESOURCE_GROUP \ |
| 115 | + --name $APPSERVICE_NAME \ |
| 116 | + --plan $APPSERVICE_PLAN \ |
| 117 | + --runtime "TOMCAT:9.0-jre8" |
| 118 | + ``` |
| 119 | + |
| 120 | +1. Deploy the WAR package to App Service. |
| 121 | + |
| 122 | + ```azurecli-interactive |
| 123 | + az webapp deploy \ |
| 124 | + --resource-group $RESOURCE_GROUP \ |
| 125 | + --name $APPSERVICE_NAME \ |
| 126 | + --src-path target/app.war \ |
| 127 | + --type war |
| 128 | + ``` |
| 129 | + |
| 130 | +## Connect Postgres Database with identity connectivity |
| 131 | + |
| 132 | +Next, connect your app to an Postgres Database Single Server with a system-assigned managed identity using Service Connector. To do this, run the [az webapp connection create](/cli/azure/webapp/connection/create#az-webapp-connection-create-postgres) command. |
| 133 | + |
| 134 | +```azurecli-interactive |
| 135 | +az webapp connection create postgres \ |
| 136 | + --resource-group $RESOURCE_GROUP \ |
| 137 | + --name $APPSERVICE_NAME \ |
| 138 | + --target-resource-group $RESOURCE_GROUP \ |
| 139 | + --server $POSTGRESQL_HOST \ |
| 140 | + --database $DATABASE_NAME \ |
| 141 | + --system-assigned-identity |
| 142 | +``` |
| 143 | + |
| 144 | +This command creates a connection between your web app and your PostgreSQL server, and manages authentication through a system-assigned managed identity. |
| 145 | + |
| 146 | +## View sample web app |
| 147 | + |
| 148 | +Run the following command to open the deployed web app in your browser. |
| 149 | + |
| 150 | +```azurecli-interactive |
| 151 | +az webapp browse \ |
| 152 | + --resource-group $RESOURCE_GROUP \ |
| 153 | + --name MyWebapp \ |
| 154 | + --name $APPSERVICE_NAME |
| 155 | +``` |
| 156 | + |
| 157 | +[!INCLUDE [cli-samples-clean-up](../../includes/cli-samples-clean-up.md)] |
| 158 | + |
| 159 | +## Next steps |
| 160 | + |
| 161 | +Learn more about running Java apps on App Service on Linux in the developer guide. |
| 162 | + |
| 163 | +> [!div class="nextstepaction"] |
| 164 | +> [Java in App Service Linux dev guide](configure-language-java.md?pivots=platform-linux) |
0 commit comments