如何实现MSAL4J与azure-security-keyvault-*结合的AKV证书认证？

问题概述 #

• 从azure-security-keyvault-keys获取的com.azure.security.keyvault.keys.models.KeyVaultKey类型，无法直接匹配MSAL4J所需的java.security.PrivateKey类型
• 如何用azure-security-keyvault-secrets获取的密钥解密私钥？

一、将KeyVaultKey转换为PrivateKey #

AKV中存储的证书私钥会以密钥形式托管，通过Azure SDK的CryptographyClient可以直接将KeyVaultKey转换为MSAL4J能用的PrivateKey：

1. 先通过KeyVaultKeyClient获取目标密钥：

KeyVaultKeyClient keyClient = new KeyVaultKeyClientBuilder()
    .vaultUrl("https://你的密钥保管库名称.vault.azure.net/")
    .credential(new DefaultAzureCredentialBuilder().build())
    .buildClient();

KeyVaultKey keyVaultKey = keyClient.getKey("你的证书名称");

2. 构建CryptographyClient并提取PrivateKey：

import com.azure.security.keyvault.keys.cryptography.CryptographyClient;
import com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;
import com.azure.security.keyvault.keys.cryptography.models.KeyVaultKeyIdentifier;
import java.security.PrivateKey;

CryptographyClient cryptoClient = new CryptographyClientBuilder()
    .keyIdentifier(new KeyVaultKeyIdentifier(keyVaultKey.getId()))
    .credential(new DefaultAzureCredentialBuilder().build())
    .buildClient();

PrivateKey privateKey = cryptoClient.getKey().getKeyMaterial();

转换后的privateKey可直接用于MSAL4J的客户端认证逻辑。

二、关于用AKV秘钥解密私钥的说明 #

正常情况下，当你从AKV获取证书对应的KeyVaultKey时，Azure SDK已经自动完成了私钥的解密操作，不需要手动调用Secrets模块处理。

只有在你拿到加密后的私钥密文（比如手动存储到Secrets中的加密私钥）时，才需要执行手动解密：

1. 从Secrets中取出加密的私钥内容：

SecretClient secretClient = new SecretClientBuilder()
    .vaultUrl("https://你的密钥保管库名称.vault.azure.net/")
    .credential(new DefaultAzureCredentialBuilder().build())
    .buildClient();

KeyVaultSecret encryptedSecret = secretClient.getSecret("加密私钥的秘钥名称");
byte[] encryptedBytes = encryptedSecret.getValue().getBytes(StandardCharsets.UTF_8);

2. 用对应密钥解密并转换为PrivateKey：

DecryptResult decryptResult = cryptoClient.decrypt(DecryptParameters.createRsaOaepParameters(encryptedBytes));
byte[] decryptedBytes = decryptResult.getPlainText();

PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(decryptedBytes);
KeyFactory keyFactory = KeyFactory.getInstance("RSA");
PrivateKey privateKey = keyFactory.generatePrivate(keySpec);

三、完整MSAL4J认证示例 #

结合获取到的PrivateKey和证书公钥，构建MSAL4J客户端并获取令牌：

// 获取证书公钥（用于构建完整的证书凭证）
CertificateClient certClient = new CertificateClientBuilder()
    .vaultUrl("https://你的密钥保管库名称.vault.azure.net/")
    .credential(new DefaultAzureCredentialBuilder().build())
    .buildClient();

KeyVaultCertificateWithPolicy cert = certClient.getCertificate("你的证书名称");
X509Certificate x509Cert = cert.getCer();

// 创建MSAL4J凭证
IClientCredential credential = ClientCredentialFactory.createFromCertificate(privateKey, x509Cert);

// 构建机密客户端
ConfidentialClientApplication cca = ConfidentialClientApplication.builder(
    "你的应用客户端ID",
    credential)
    .authority("https://login.microsoftonline.com/你的租户ID/")
    .build();

// 请求令牌
ClientCredentialParameters parameters = ClientCredentialParameters.builder(
    Collections.singleton("https://graph.microsoft.com/.default"))
    .build();

IAuthenticationResult result = cca.acquireToken(parameters).join();

内容的提问来源于stack exchange，提问作者Xtonic Chen