Skip to content

Commit 49991a8

Browse files
gsteve88gsteve88
committed
Created Java Entra include and other edits
1 parent 5743a22 commit 49991a8

3 files changed

+54
-18
lines changed

‎includes/iot-hub-howto-connect-service-iothub-entra-java.md

Lines changed: 52 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -11,25 +11,65 @@ ms.manager: lizross
1111
ms.date: 11/06/2024
1212
---
1313

14-
### Microsoft Entra client secret credential
14+
A backend app that uses Microsoft Entra must successfully authenticate and obtain a security token credential before connecting to IoT Hub. This token is passed to a IoT Hub connection method. For general information about setting up and using Microsoft Entra for IoT Hub, see [Control access to IoT Hub by using Microsoft Entra ID](/azure/iot-hub/authenticate-authorize-azure-ad).
1515

16-
Use [ClientSecretCredential](/java/api/com.azure.identity.clientsecretcredential) to authenticate an application with Microsoft Entra.
16+
For an overview of Java SDK authentication, see [Getting started with user authentication on Azure](https://learn.microsoft.com/en-us/azure/developer/java/sdk/authentication/azure-hosted-apps).
1717

18-
`ClientSecretCredential` is configured using [ClientSecretCredentialBuilder](/java/api/com.azure.identity.clientsecretcredentialbuilder).
18+
##### Configure Microsoft Entra app
19+
20+
You must set up a Microsoft Entra app that is configured for your preferred authentication credential. The app contains parameters such as client secret that are used by the backend application to authenticate. The available app authentication configurations are:
21+
22+
* Client secret
23+
* Certificate
24+
* Federated identity credential
25+
26+
Microsoft Entra apps may require specific role permissions depending on operations being performed. For example, [IoT Hub Twin Contributor](/azure/role-based-access-control/built-in-roles/internet-of-things#iot-hub-twin-contributor) is required to enable read and write access to a IoT Hub device and module twins. For more information, see [Manage access to IoT Hub by using Azure RBAC role assignment](/azure/iot-hub/authenticate-authorize-azure-ad?#manage-access-to-iot-hub-by-using-azure-rbac-role-assignment).
27+
28+
For more information about setting up a Microsoft Entra app, see [Quickstart: Register an application with the Microsoft identity platform](/entra/identity-platform/quickstart-register-app).
29+
30+
##### Authenticate using DefaultAzureCredential
31+
32+
The easiest way to use Microsoft Entra to authenticate a backend application is to use [DefaultAzureCredential](/azure/developer/java/sdk/authentication/credential-chains#defaultazurecredential-overview), but it's recommended to use a different method in a production environment including a specific `TokenCredential` or pared-down `ChainedTokenCredential`. For simplicity, this section describes authentication using `DefaultAzureCredential` and Client secret.
33+
For more information about the pros and cons of using `DefaultAzureCredential`, see
34+
[ChainedTokenCredential](/java/sdk/authentication/credential-chains).
35+
36+
[DefaultAzureCredential](/java/api/com.azure.identity.defaultazurecredential) supports different authentication mechanisms and determines the appropriate credential type based on the environment it's executing in. It attempts to use multiple credential types in an order until it finds a working credential.
37+
38+
You can authenticate Microsoft Entra app credentials using [DefaultAzureCredentialBuilder](/java/api/com.azure.identity.defaultazurecredentialbuilder). Save connection parameters such as client secret tenantID, clientID, and client secret values as environmental varaibles. Once the `TokenCredential` is created, pass it to [ServiceClient](https://learn.microsoft.com/en-us/java/api/com.azure.core.annotation.serviceclient) or other builder as the 'credential' parameter.
39+
40+
In this example, `DefaultAzureCredentialBuilder` will attempt to authenticate a connection from the list described in [DefaultAzureCredential](/java/api/com.azure.identity.defaultazurecredential). The result of a successful Microsoft Entra authentication is a security token credential that is passed to a constructor.
1941

2042
```java
21-
TokenCredential clientSecretCredential = new ClientSecretCredentialBuilder().tenantId(tenantId)
22-
.clientId(clientId)
23-
.clientSecret(clientSecret)
24-
.build();
43+
TokenCredential defaultAzureCredential = new DefaultAzureCredentialBuilder().build();
2544
```
2645

27-
### Microsoft Entra client certificate credential
46+
##### Authenticate using ClientSecretCredentialBuilder
47+
48+
You can use [ClientSecretCredentialBuilder](/java/api/com.azure.identity.clientsecretcredentialbuilder) to create a credential using client secret information. If successful, this method returns a [TokenCredential](/java/api/com.azure.core.credential.tokencredential).
49+
50+
In this example, Microsoft Entra app registration client secret, client ID, and tenant ID values have been added to environment variables. These environment variables are used by `ClientSecretCredentialBuilder` to build the credential.
51+
52+
```java
53+
// Credentials can be built from types from the Azure Identity library like ClientSecretCredential.
54+
// The Azure Identity library also defines other implementations of the TokenCredential interface such as
55+
// DefaultAzureCredential, InteractiveBrowserCredential, and many others.
56+
57+
string clientSecretValue = System.getenv("AZURE_CLIENT_SECRET");
58+
string clientID = System.getenv("AZURE_CLIENT_ID");
59+
string tenantID = System.getenv("AZURE_TENANT_ID");
60+
61+
TokenCredential credential =
62+
new ClientSecretCredentialBuilder()
63+
.tenantId(tenantID)
64+
.clientId(clientID)
65+
.clientSecret(clientSecretValue)
66+
.build();
67+
```
2868

29-
You can use [ClientCertificateCredential](/java/api/com.azure.identity.clientcertificatecredential) to create a `TokenCredential` using a certificate.
69+
##### Authenticate using InteractiveBrowserCredential
3070

31-
The `TokenCredential` can then be passed to service constructors such as:
71+
Use [InteractiveBrowserCredential](https://learn.microsoft.com/en-us/java/api/com.azure.identity.interactivebrowsercredential) to authenticate a user sign-in using a web browser.
3272

33-
* [DeviceTwin](/java/api/com.microsoft.azure.sdk.iot.service.devicetwin.devicetwin?#com-microsoft-azure-sdk-iot-service-devicetwin-devicetwin-devicetwin(java-lang-string-com-azure-core-credential-tokencredential))
73+
##### Code samples
3474

35-
For more information about Microsoft Entra app registration, see [Quickstart: Register an application with the Microsoft identity platform](/entra/identity-platform/quickstart-register-app).
75+
For working samples of Microsoft Entra service authentication, see [Role based authentication sample](github.com/Azure/azure-iot-service-sdk-java/tree/main/service/iot-service-samples/role-based-authorization-sample).

‎includes/iot-hub-howto-connect-service-iothub-entra-node.md

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -53,16 +53,12 @@ import { DefaultAzureCredential } from "@azure/identity";
5353
const credential = new DefaultAzureCredential();
5454
```
5555

56-
The resulting credential token can then be passed to a connection method to connect to IoT Hub method for any SDK client that accepts Microsoft Entra credentials:
56+
The resulting credential token can then be passed to [fromTokenCredential](/javascript/api/azure-iothub/registry?#azure-iothub-registry-fromtokencredential) to connect to IoT Hub for any SDK client that accepts Microsoft Entra credentials:
5757

5858
* [Registry](/javascript/api/azure-iothub/registry?#azure-iothub-registry-fromtokencredential)
5959
* [Client](/javascript/api/azure-iothub/client?#azure-iothub-client-fromtokencredential)
6060
* [JobClient](/javascript/api/azure-iothub/jobclient?#azure-iothub-jobclient-fromtokencredential)
6161

62-
##### Connect to IoT Hub
63-
64-
Use [fromTokenCredential](/javascript/api/azure-iothub/registry?#azure-iothub-registry-fromtokencredential) to create a service connection to IoT Hub using a Microsoft Entra token credential.
65-
6662
`fromTokenCredential` requires two parameters:
6763

6864
* The Azure service URL - The Azure service URL should be in the format `{Your Entra domain URL}.azure-devices.net` without a `https://` prefix. For example, `MyAzureDomain.azure-devices.net`.

‎includes/iot-hub-howto-connect-service-iothub-entra-python.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ credential = DefaultAzureCredential()
5353
The resulting [AccessToken](/python/api/azure-core/azure.core.credentials.accesstoken) can then be passed to `from_token_credential` to connect to IoT Hub method for any SDK client that accepts Microsoft Entra credentials:
5454

5555
* [IoTHubRegistryManager](/python/api/azure-iot-hub/azure.iot.hub.iothubregistrymanager?#azure-iot-hub-iothubregistrymanager-from-token-credential) to create a service connection to IoT Hub using an Entra token credential.
56-
* [IoTHubJobManager](/python/api/azure-iot-hub/azure.iot.hub.iothubjobmanager?view=azure-python&#azure-iot-hub-iothubjobmanager-from-token-credential)
56+
* [IoTHubJobManager](/python/api/azure-iot-hub/azure.iot.hub.iothubjobmanager?#azure-iot-hub-iothubjobmanager-from-token-credential)
5757
* [DigitalTwinClient](/python/api/azure-iot-hub/azure.iot.hub.digitaltwinclient?#azure-iot-hub-digitaltwinclient-from-token-credential)
5858
* [IoTHubHttpRuntimeManager](/python/api/azure-iot-hub/azure.iot.hub.iothubhttpruntimemanager?#azure-iot-hub-iothubhttpruntimemanager-from-token-credential)
5959
* [IoTHubConfigurationManager](/python/api/azure-iot-hub/azure.iot.hub.iothubconfigurationmanager?#azure-iot-hub-iothubconfigurationmanager-from-token-credential)

0 commit comments

Comments
 (0)