Authentication Application Credentials with Certificate (Sign JWT with Private Key)

Description

Similar to Assplication-only access but with JWT sign with Private Key [API reference]

Instructions

Follow these simple steps below to create Microsoft Entra ID application with application access permissions. Using following steps, you can grant very granular app permissions to access File(s). Choose permission based on your need.

Create OAuth app

1. Navigate to the Azure Portal and log in using your credentials.
2. Access Microsoft Entra ID.
3. Register a new application by going to App registrations and clicking on New registration button:
   INFO: Find more information on how to register an application in Graph API reference.
4. When configuration window opens, configure these fields:
   • Supported account type
     • e.g. select Accounts in this organizational directory only if you need access to data in your organization only.
   
5. After registering the app, copy the Application (client) ID for later:
6. Then copy OAuth authorization endpoint (v2) & OAuth token endpoint (v2) URLs:

Configure App Permissions

1. Continue by adding permissions for the app by going to the API permissions section, and clicking on Add a permission:
2. Select Microsoft Graph:
3. Then choose Application permissions option:
4. Continue by adding these Files (OneDrive) permissions (Just search for "Files" and then select desired permissions):
5. Finish by clicking Add permissions button:
6. Now it's time to Grant admin consent for your application:
7. Confirm all the permissions are granted:

Generate a Self-Signed Certificate

Now let's go through setting up a certificate-based authentication flow for Microsoft Graph or other Azure AD protected APIs using client credentials and a JWT.

You can use OpenSSL or any other way to generate Certificate file but to make it simple we will use below example PowerShell script.

Open PowerShell and execute code listed in below steps.

# Run this in PowerShell
#Change .AddYears(1) to desired number. By default it expires certificate in one year as per below code.

$cert = New-SelfSignedCertificate `
  -Subject "CN=MyClientAppCert" `
  -KeySpec Signature `
  -KeyExportPolicy Exportable `
  -KeyLength 2048 `
  -CertStoreLocation "Cert:\CurrentUser\My" `
  -KeyAlgorithm RSA `
  -HashAlgorithm SHA256 `
  -NotAfter (Get-Date).AddYears(1) `
  -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider"

# Export private key (.pfx)  - Keep this with you to make API calls (SECRET KEY - DONOT SHARE)
$pfxPath = "$env:USERPROFILE\Desktop\private_key.pfx"
$pwd = ConvertTo-SecureString -String "yourStrongPassword123" -Force -AsPlainText
Export-PfxCertificate -Cert $cert -FilePath $pfxPath -Password $pwd

# Export public certificate (.cer) - UPLOAD this to Azure Portal
$cerPath = "$env:USERPROFILE\Desktop\public_key.cer"
Export-Certificate -Cert $cert -FilePath $cerPath

Upload the Certificate (i.e. Public Key *.cer)

1. In your App Registration, go to Certificates & secrets
2. Under Certificates, click Upload certificate
3. Select the .cer file (public certificate)
4. Click Select a file (Browse button)
5. Select public key file (*.cer) from local machine and click OK to upload

Configure ZappySys Connection - Use private key (i.e. *.pfx or *.pem)

1. Go to SSIS package or ODBC data source and use the copied values in Application Credentials authentication configuration:
   • In the Token URL field paste the OAuth token endpoint (v2) URL value you copied in the previous step.
   • In the Client ID field paste the Application (client) ID value you copied in the previous step.
2. Configure private key
   • go to Certificate Tab
   • Change Storage Mode to Disk File: *.pfx format (PKCS#12).
     NOTE: You can also use Stored In LocalMachine mode if PFX file already imported in the Local Certificate Storage Area - User Store OR Machine Store.

     If you used OpenSSL to generate key pair then use Disk File: *.pem format (PKCS#8 or PKCS#1) Mode for Cert Store Location.

   • Supply the key file path
   • Supply the certificate password (same password used in earlier PowerShell script)
3. Now go back to General Tab, choose Default Group / User Id and Default Drive Id from the drop down menu.
4. Click Test connection see everything is good

Parameters