Aquire access token via HTTP request

Question

I'm writing a Java app that aquires a token via the provided MS utility lib called adal4j.

It provides finished methods, I just need to provide the username, password, authority and my clientid. The code looks like this and works perfectly:

public AuthenticationResult getAccessTokenFromUserCredentials() throws Exception {
        AuthenticationContext context;
        AuthenticationResult result;
        ExecutorService service = null;
        try {
            service = Executors.newFixedThreadPool(1);
            context = new AuthenticationContext(this.authority, false, service);
            Future<AuthenticationResult> future = context.acquireToken(
                    "https://mysite.sharepoint.com", this.clientId, this.userName, password,
                    null);
            result = future.get();
        } finally {
            service.shutdown();
        }

        if (result == null) {
            throw new ServiceUnavailableException(
                    "authentication result was null");
        }
        return result;
    }

As I said, this works perfectly, but due to some proxy issues cannot be used where I need to use it.

My question is, can I get the accessToken via a simple HTTP request somehow? Like:

HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod("GET");
conn.setRequestProperty("username", username);
conn.setRequestProperty("password", password);

Any tips for getting an access token from Java with a simple HTTP request would be greatly appreciated, thanks!

Answer 1

Actually, this is a OAUTH authentication process. So the library goes to a first endpoint (login.microsoftonline.com) to authenticate the user (generating an auth token), then requests an access token for the resource you need (for example a site collection access token) using the auth token you got from the first call.

Generally speaking, such a process requires redirection or iframes since it requires the user authentication on the microsoft domain in the first place. I wonder how the library manages to take only credentials and give back an access token.

Short answer, you can actually reimplement the library using a proxy, but microsoft uses the standard OAUTH process, so all you gotta do is implement this authentication process yourself.

Official documentation : https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-code

Auth token URL : https://login.microsoftonline.com/{tenant}/oauth2/authorize with parameters

Acces token URL : https://login.microsoftonline.com/{tenant}/oauth2/token with parameters

Hope this helps!