Package io.jmix.email.authentication.impl

Class MicrosoftOAuth2AuthorizationCodeFlow

java.lang.Object

io.jmix.email.authentication.impl.AbstractOAuth2Flow

io.jmix.email.authentication.impl.MicrosoftOAuth2AuthorizationCodeFlow

All Implemented Interfaces:

OAuth2AuthorizationCodeFlow

@NullMarked
public class MicrosoftOAuth2AuthorizationCodeFlow
extends AbstractOAuth2Flow
implements OAuth2AuthorizationCodeFlow

Authorization code flow for Microsoft accounts. MSAL appends the reserved scopes (offline_access etc.) required to obtain a refresh token.

Field Summary

Fields inherited from class io.jmix.email.authentication.impl.AbstractOAuth2Flow

emailerProperties, refreshTokenManager

Constructor Summary

Constructors

Constructor	Description
MicrosoftOAuth2AuthorizationCodeFlow(EmailerProperties emailerProperties, EmailRefreshTokenManager refreshTokenManager)

Method Summary

Modifier and Type	Method	Description
protected com.microsoft.aad.msal4j.IAuthenticationResult	acquireTokenByAuthorizationCode(RefreshTokenCapturingCacheAspect cacheAspect, String authorizationCode, String redirectUri)
protected String	buildAuthorityUrl()
String	buildAuthorizationUrl(String redirectUri, String state)	The URL is built manually: the authorization response must come back as a GET redirect so that the callback view can read the query parameters (a POST is also rejected by the CSRF protection), but MSAL silently overrides ResponseMode.QUERY with form_post.
protected com.microsoft.aad.msal4j.ConfidentialClientApplication	buildClientApplication(@Nullable RefreshTokenCapturingCacheAspect cacheAspect)
void	completeAuthorization(String authorizationCode, String redirectUri)	Exchanges the authorization code received on the callback for tokens and stores the obtained refresh token via EmailRefreshTokenManager.
protected Set<String>	getAuthorizationScopes()	Scopes requested on the consent page.
protected String	getBaseAuthorityUrl()
protected @Nullable String	getCapturedRefreshToken(RefreshTokenCapturingCacheAspect cacheAspect)
protected Set<String>	getScopes()
protected String	getTenant()

Methods inherited from class io.jmix.email.authentication.impl.AbstractOAuth2Flow

encodeForm, getClientId, getRequiredProperty, getSecret

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

MicrosoftOAuth2AuthorizationCodeFlow

public MicrosoftOAuth2AuthorizationCodeFlow(EmailerProperties emailerProperties,
 EmailRefreshTokenManager refreshTokenManager)

Method Details

buildAuthorizationUrl

public String buildAuthorizationUrl(String redirectUri,
 String state)

The URL is built manually: the authorization response must come back as a GET redirect so that the callback view can read the query parameters (a POST is also rejected by the CSRF protection), but MSAL silently overrides ResponseMode.QUERY with form_post. The Entra endpoint itself supports response_mode=query as defined by the OAuth spec.

Specified by:

buildAuthorizationUrl in interface OAuth2AuthorizationCodeFlow

Parameters:

redirectUri - application callback URI registered for the OAuth client

state - opaque value used to protect the round trip against CSRF

Returns:

URL to redirect the user to

getAuthorizationScopes

protected Set<String> getAuthorizationScopes()

Scopes requested on the consent page. Unlike MSAL-built requests, the manually built URL must include the reserved scopes (offline_access is required to receive a refresh token) explicitly.

completeAuthorization

public void completeAuthorization(String authorizationCode,
 String redirectUri)

Description copied from interface: OAuth2AuthorizationCodeFlow

Exchanges the authorization code received on the callback for tokens and stores the obtained refresh token via EmailRefreshTokenManager.

Specified by:

completeAuthorization in interface OAuth2AuthorizationCodeFlow

Parameters:

authorizationCode - code received on the redirect URI

redirectUri - the same redirect URI that was used to build the authorization URL

acquireTokenByAuthorizationCode

protected com.microsoft.aad.msal4j.IAuthenticationResult acquireTokenByAuthorizationCode(RefreshTokenCapturingCacheAspect cacheAspect,
 String authorizationCode,
 String redirectUri)
                                                                                  throws Exception

Throws:

Exception

getCapturedRefreshToken

protected @Nullable String getCapturedRefreshToken(RefreshTokenCapturingCacheAspect cacheAspect)

buildClientApplication

protected com.microsoft.aad.msal4j.ConfidentialClientApplication buildClientApplication(@Nullable RefreshTokenCapturingCacheAspect cacheAspect)

getScopes

protected Set<String> getScopes()

buildAuthorityUrl

protected String buildAuthorityUrl()

getBaseAuthorityUrl

protected String getBaseAuthorityUrl()

getTenant

protected String getTenant()