How to turn Azure access token into session cookie? - azure

Question

I have a Tomcat app configured with Azure ADFS SSO over SAML. SSO is working, however I now need to access my Tomcat app via restful API with Azure ADFS SSO.
I was able to get access token from Azure AD SSO by doing
curl -X POST -d 'grant_type=client_credentials&client_id=<APP_ID>&client_secret=<PASSWORD>&resource=https%3A%2F%2Fmanagement.azure.com%2F' https://login.microsoftonline.com/<TENANT_ID>/oauth2/token | jq .
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1592  100  1420  100   172   3169    383 --:--:-- --:--:-- --:--:--  3553
{
  "token_type": "Bearer",
  "expires_in": "3599",
  "ext_expires_in": "3599",
  "expires_on": "1592338746",
  "not_before": "1592334846",
  "resource": "https://management.azure.com/",
  "access_token": "MY_TOKEN"
}
If I don't have SSO turn on, I would usually create seesion cookie in my Tomcat app doing this
curl -v -k -X POST 'https://<HOSTNAME>/<APP>/j_spring_security_check?j_username=<USERNAME>&j_password=<PASSWORD>' -c ./cookie.txt
I've tried passing token as header, but didn't work
curl -v -k -X POST 'https://<HOSTNAME>/<APP>/j_spring_security_check?j_username=<USERNAME>&j_password=<PASSWORD>' -c ./cookie.txt --header "Authorization: Bearer MY_TOKEN"
Cookie.txt created.
Then I tried to call a GET API, didn't get the expected response JSON, but here is the verbose log from curl.
curl -v -k -X GET 'https://<HOSTNAME>/<APP>/source/v1/getSources?type=EXTERNAL&count=2&sortAttr=name&sortDir=ASC' -b ./cookie.txt | jq .
Note: Unnecessary use of -X or --request, GET is already inferred.
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:04 --:--:-- 0* Trying 192.168.56.210...
* TCP_NODELAY set
0 0 0 0 0 0 0 0 --:--:-- 0:00:05 --:--:-- 0* Connected to HOSTNAME> (192.168.56.210) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [223 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [81 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [859 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [333 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [70 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: C=blah; ST=us; L=us; O=blah; OU=blah; CN=blah
* start date: Jun 16 14:21:29 2020 GMT
* expire date: Sep 14 14:21:29 2020 GMT
* issuer: C=blah; ST=us; L=us; O=blah; OU=blah; CN=blah
* SSL certificate verify result: self signed certificate (18), continuing anyway.
> GET /qdc/source/v1/getSources?type=EXTERNAL&count=2&sortAttr=name&sortDir=ASC HTTP/1.1
> Host: dfz.local:8443
> User-Agent: curl/7.64.1
> Accept: */*
> Cookie: JSESSIONID=1D244E5E4DBA30399E856E01909B0DDF
>
< HTTP/1.1 302 Found
< Server: Apache-Coyote/1.1
< Cache-control: no-cache, no-store
< Pragma: no-cache
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Strict-Transport-Security: max-age=31536000 ; includeSubDomains
< Location: https://login.microsoftonline.com/f08ee33a-102b-4180-998b-3fdd8acc49ab/saml2?SAMLRequest=hZLNTsMwEIRfxdp7EseJwLGaogJCIIGoSODAzXGc1lViF69TIZ6e0B8BFzhantnxzufZxfvQk532aJwtIY0pEG2Va41dlfBc30QcLuYzlEPPtmIxhrV90m%2BjxkAmo0VxuClh9FY4iQaFlYNGEZSoFg%2F3gsVUbL0LTrkeyAJR%2BzBFXTmL46B9pf3OKP38dF%2FCOoQtiiRpu4%2B4d0r2gud5lry1KvlKSarqEcj1FG2sDPvnnhy9WxkbD0Z5h64LzvbG6li5Ieko1zrLZJRS1kR5ymlUFLyJsq5tuVQqL2Szn86A3Div9H7FEjrZowZyd12C5Oema7rNmVkVWdqwRm1yzlKzWVNTZJMGlxLR7PS3C3HUdxaDtKEERhmN6FmU8pqlIqOC8pin2SuQ5bGXS2MPff9VYnMQobit62W0fKxqIC8nbpMAjpTEPt3%2FxPP3YHliAvP%2FCAw6yFYGOUt%2BRs2Px9%2F%2FY%2F4J&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=HcbOW7%2BIOjXNr73H%2BKRHEtIbjJGPHa5CsXCeoSzVMVf5lCu07AEtpVPZmVw9IViBZcniKqhnC2zokz6ZOtVehsuNcSLDWpqViLLRicqBtRenmfe9RL5vI%2BlpcdS92wRT44V%2FMH1t3y7lILea34sLP2ySz0XVORSxL7FzEade3Q72cHQyu1xBuFlf9x7BUjxe8ZO5rZeGFsq98AQ9IwZIlJ3%2Fs%2F8Kp3eexw%2BmfVRhLU7eNLefDX%2BMfux%2BHvlKVlQpI6iHR1LSIEcNXX6nV%2BEAt7oa20FBDXV0PSGBy8hcBgzyPLhwFMWhe5%2BzUt9ssL2IO9kk8loWBNQek6x%2Bmpzw5w%3D%3D
< Content-Length: 0
< Date: Thu, 18 Jun 2020 21:30:08 GMT
<
0 0 0 0 0 0 0 0 --:--:-- 0:00:05 --:--:-- 0
* Connection #0 to host dfz.local left intact
* Closing connection 0

Answer 1

Curl for client credential grant type
curl -X POST -d “grant_type=client_credentials&client_id=clientid&client_secret= secret&scope= https%3A%2F%2Fgraph.microsoft.com%2F.default” https://login.microsoftonline.com/tenantid/oauth2/v2.0/token
After getting the token use below query to pass the token in header
curl -H "Authorization: Basic <_your_token_>" http://www.example.com