spring_boot_aad_kv

Small demo of a dockerized Spring Boot web application with Azure AD and KeyVault.

This demo shows multiple aspects:

• It's a Spring Boot-based web application
• The web app is configured solely via environment variables (to be a good Docker citizen) and Azure KeyVault for confidential values
  • Specifically, the SQL Azure connection information (connection string, username and password) come in from KeyVault.
• The web app authenticates users via Azure AD.
  • On the / endpoint, it enforces group membership.
  • On the /claims endpoint, it prints out the user's security token's properties.
  • On GET /pet, POST /pet/create, GET /pet/123 and DELETE /pet/123 we authenticate the user, and interact with SQL Azure in the back.
• Security Setup
  • The application has a service principal, which is used to query group membership information in the Azure Active Directory Graph API.
  • The application uses a user-assigned managed identity to authN to KeyVault to fetch the Azure SQL DB's connection string.

Overview

Demo

• MP4 Download

misc links

• Tutorial: Secure a Java web app using the Spring Boot Starter for Azure Active Directory
• PetController
• Azure Key Vault Secrets Spring Boot Starter Sample
• Bootiful Azure: SQL-based data access with Microsoft SQL Server (2/6)

Docs

• ARM template functions
• Microsoft.Sql/servers
• Microsoft.KeyVault/vaults
• Microsoft.KeyVault/vaults/accessPolicies
• Microsoft.KeyVault/vaults/secrets
• Microsoft.ContainerRegistry/registries
• Microsoft.ContainerRegistry/registries/tasks
• Microsoft.ContainerInstance/containerGroups
• Microsoft.ManagedIdentity/userAssignedIdentities