Azure / Azure/azure-sdk-for-java

azure-security-keyvault-jca-2.9.0.jar file checking for Azure RBAC permisions in keyvault level

Open
#46,130 3 comments 0 reactions 2 assignees Assigned to @Netyyyy View on GitHub
Client customer-reported feature-request KeyVault needs-team-attention
Dominant language
Java
Stars
2.6k
Forks
2.2k
Avg merge
2d 8h
Merged PRs (30d)
178

Description

**Describe the bug**
Signing of jar file using azure-security-keyvault-jca-2.9.0.jar file works only when the role "Key Vault Certificate User" is added to key vault level and not when its added in the certificate level of a certificate present inside keyvault.

***Exception or Stack Trace***
The below error is produced while trying to sign a jar file using certificate from Azurekeyvault:
jarsigner: Certificate chain not found for: sign-cert. sign-cert must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain

**To Reproduce**
Ensure the the role "Key Vault Certificate User" is assigned to certificate inside a keyvault and not within the key vault level itself and issue the command below:
jarsigner -verbose -keystore NONE -storetype AzureKeyVault -signedjar helloworld-signed.jar helloworld.jar "sign-cert" -storepass '""' -providerName AzureKeyVault -providerClass com.azure.security.keyvault.jca.KeyVaultJcaProvider "-J-Dazure.keyvault.uri=https://yourkeyvault.vault.azure.net/" "-J-Dazure.keyvault.tenant-id=tenant_id" "-J-Dazure.keyvault.client-id=client_id" "-J-Dazure.keyvault.client-secret=secret" -tsa http://timestamp.digicert.com -providerPath "azure-security-keyvault-jca-2.9.0.jar"

***Code Snippet***
Add the code snippet that causes the issue.

**Expected behavior**
The jarsigning should work based on RBAC configured in the certificate level within a keyvault

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Setup (please complete the following information):**
- OS: [e.g. iOS] Windows
- IDE: [e.g. IntelliJ]
- Library/Libraries: [e.g. com.azure:azure-core:1.16.0 (groupId:artifactId:version)]
- Java version: [e.g. 8] 21.0.7
- App Server/Environment: [e.g. Tomcat, WildFly, Azure Function, Apache Spark, Databricks, IDE plugin or anything special]
- Frameworks: [e.g. Spring Boot, Micronaut, Quarkus, etc]

If you suspect a dependency version mismatch (e.g. you see `NoClassDefFoundError`, `NoSuchMethodError` or similar), please check out [Troubleshoot dependency version conflict article](https://aka.ms/azsdk/java/dependency/troubleshoot) first. If it doesn't provide solution for the problem, please provide:
- verbose dependency tree (`mvn dependency:tree -Dverbose`)
- exception message, full stack trace, and any available logs

**Additional context**
If the role "Key Vault Certificate User" is added to key vault level then the signing works which is not expected as this exposes all the certificates within that keyvault to serviceprincipal

**Information Checklist**
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report
- [x] Bug Description Added
- [x] Repro Steps Added
- [x] Setup information Added

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.