InteractiveBrowserCredential Class

Interactive browser authentication is a type of authentication flow offered by Microsoft Entra ID that enables users to sign in to applications and services using a web browser. With interactive browser authentication, the user is directed to a sign-in webpage and is prompted to enter their credentials. After the user successfully authenticates, Microsoft Entra ID issues a security token that the application can use to authorize the user's access to its resources. For more information refer to the interactive browser authentication documentation.

Required configuration:

To use InteractiveBrowserCredential, you need to register an application in Microsoft Entra ID with permissions to log in on behalf of a user. Follow the steps below to configure your registered application.

1. Go to Microsoft Entra ID in Azure portal and find your app registration.
2. Navigate to the Authentication section.
3. Under Suggested Redirected URIs, check the URI that ends with /common/oauth2/nativeclient.
4. Under Authentication->Advanced settings, enable "Allow public client flows."

These steps will let the application authenticate, but it still won't have permission to log you into Active Directory, or access resources on your behalf. To address this issue, navigate to API Permissions, and enable Microsoft Graph and the resources you want to access, such as Azure Service Management, Key Vault, and so on. You also need to be the admin of your tenant to grant consent to your application when you log in for the first time. In redirectUrl(String redirectUrl), a redirect URL can be specified. It configures the Redirect URL where STS will callback the application with the security code. It is required if a custom client id is specified via clientId(String clientId) and must match the redirect URL specified during the application registration. You can add the redirect URL to the Redirect URIs subsection under the Authentication section of your registered Microsoft Entra application.

Sample: Construct InteractiveBrowserCredential

The following code sample demonstrates the creation of a InteractiveBrowserCredential, using the InteractiveBrowserCredentialBuilder to configure it. By default, the credential targets a localhost redirect URL, to override that behaviour a redirectUrl(String redirectUrl) can be optionally specified. Once this credential is created, it may be passed into the builder of many of the Azure SDK for Java client builders as the 'credential' parameter.

TokenCredential interactiveBrowserCredential = new InteractiveBrowserCredentialBuilder()
     .redirectUrl("http://localhost:8765")
     .build();