Authenticate with application id using Certificated-based Authentication

Open

#2,075 opened on Jul 9, 2024 10 comments 0 reactions 1 assignee View on GitHub

@Ndiritu is already working on this.

Since Jul 15, 2024.

Assessment

This issue has not been assessed yet.

Description

Status: Needs Investigation type:question

I registered the app on the Microsoft Entra admin center by referring to this page:

https://learn.microsoft.com/en-us/graph/auth-v2-service?tabs=http

Then I created public/private key using openssl. Here is the commands.

$ openssl genrsa -out ms365-private.key 2048
$ openssl req -new -x509 -key ms365-private.key -out ms365-public.crt -days 365000

Uploaded the public key (ms365-private.key) on the Microsoft Entra admin center, and I created this code.

TokenCredential credential = new ClientCertificateCredentialBuilder().tenantId("xxxxxxxx")
		.clientId("xxxxxxxx")
		.pemCertificate("/xxxx/xxxxx/ms365-private.key")
		.build();
graphClient = new GraphServiceClient(credential);

but if i execute some methods on this graphClient , this following error occurs

[ERROR] com.azure.identity.implementation.util.CertificateUtil.performLogging - PEM certificate provided does not contain -----BEGIN CERTIFICATE-----END CERTIFICATE----- block 
java.lang.IllegalArgumentException: PEM certificate provided does not contain -----BEGIN CERTIFICATE-----END CERTIFICATE----- block
    at com.azure.identity.implementation.util.CertificateUtil.publicKeyFromPem(CertificateUtil.java:79)
    at com.azure.identity.implementation.IdentityClientBase.getConfidentialClient(IdentityClientBase.java:196)
    at com.azure.identity.implementation.IdentitySyncClient.lambda$new$2(IdentitySyncClient.java:91)
    at com.azure.identity.implementation.SynchronousAccessor.getValue(SynchronousAccessor.java:45)
    at com.azure.identity.implementation.IdentitySyncClient.authenticateWithConfidentialClientCache(IdentitySyncClient.java:171)
    at com.azure.identity.ClientCertificateCredential.getTokenSync(ClientCertificateCredential.java:150)
    at com.microsoft.kiota.authentication.AzureIdentityAccessTokenProvider.getAuthorizationToken(AzureIdentityAccessTokenProvider.java:146)
    at com.microsoft.kiota.authentication.BaseBearerTokenAuthenticationProvider.authenticateRequest(BaseBearerTokenAuthenticationProvider.java:46)

Q. Should I also specify public key? If so, how to specify public key by using ClientCertificateCredentialBuilder?

Dominant language: Java
Stars: 444
Forks: 154
Avg merge: 18h 28m
Merged PRs (30d): 4

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Compatibility certification request for FJ-EAP 2.1.0 for Jakarta EE Platform 11 Open

certification

Difficulty 1/5 Under an hour Newbie friendliness 80/100

jakartaee/platform#1359 · Opened Sep 24, 2026
Python guide test runner copies stale Micronaut Test Resources state Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

micronaut-projects/micronaut-guides#1856 · Opened Sep 23, 2026
[BUG] ECR GetAuthorizationToken returns a proxyEndpoint for the default region, not the request's Open

bug ecr

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

floci-io/floci#4264 · Opened Sep 23, 2026
Drop point numbers from GitHub milestones Open

Needs: Triage Type: Feature request

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

AntennaPod/AntennaPod#8794 · Opened Sep 23, 2026
[aw] Issue Classification Agent timed out Open

agentic-workflows

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

github/copilot-sdk#2760 · Opened Sep 23, 2026

More Java issues