Security improvements in Spring Cloud Azure AAD by rujche · Pull Request #49033 · Azure/azure-sdk-for-java

rujche · 2026-05-04T04:39:27Z

This pull request introduces breaking changes to Azure Active Directory (AAD) resource server configuration in the Spring Cloud Azure autoconfigure module, primarily strengthening security by requiring explicit tenant configuration and enforcing audience validation by default. The changes also update related tests and documentation to reflect these new requirements.

Breaking changes to AAD resource server configuration:

The resource server now requires spring.cloud.azure.active-directory.profile.tenant-id to be set to a specific, non-reserved tenant ID. Using empty, common, organizations, or consumers values will cause application startup to fail with an IllegalArgumentException. [1]], [2]])
The AadAuthenticationFilter now enables explicit audience validation by default. JWT tokens must have an aud claim matching either the configured client ID or App ID URI; tokens for other audiences are rejected. [1]], [2]], [3]])

Security improvements:

The JWT issuer validator (AadJwtIssuerValidator) now strictly checks that the issuer is in the trusted set for the configured tenant, removing fallback to broad Microsoft endpoints. ([sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aad/security/jwt/AadJwtIssuerValidator.javaL21-R37])
The resource server's default validators now include a tenant ID (tid) claim check and use the trusted issuer repository for issuer validation. ([sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfiguration.javaR70-R113])

Documentation and error messaging:

The changelog and exception messages are updated to clearly communicate the new requirements and error scenarios. [1]], [2]])

Test updates:

Unit tests and context runners are updated to require an explicit tenant ID in their property values, ensuring test coverage for the new validation logic. [1]], [2]], [3]], [4]])

These changes enforce best security practices for OAuth2/OIDC resource servers and prevent misconfiguration or cross-application token acceptance.

All SDK Contribution checklist:

The pull request does not introduce [breaking changes]
CHANGELOG is updated for new features, bug fixes or other significant changes.
I have read the contribution guidelines.

General Guidelines and Best Practices

Title of the pull request is clear and informative.
There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

Pull request includes test coverage for the included changes.

Copilot

Pull request overview

This PR tightens default AAD JWT validation behavior in spring-cloud-azure-autoconfigure by enforcing tenant-aware issuer validation for single-tenant resource servers and enabling explicit audience validation by default in AadAuthenticationFilter.

Changes:

Wire AadResourceServerConfiguration issuer validation to use AadTrustedIssuerRepository for single-tenant tenant IDs while preserving legacy prefix-based issuer validation for common/organizations/consumers.
Change AadAuthenticationFilter default constructors to enable explicit audience checking by default.
Add/update tests covering the new default behaviors.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aad/filter/AadAuthenticationFilter.java	Switch constructor defaults to enable explicit audience validation.
sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfiguration.java	Use trusted-issuer exact matching for single-tenant issuer validation; keep multi-tenant legacy behavior.
sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/implementation/aad/filter/AadAuthenticationFilterTests.java	Add tests validating constructor defaults for explicit audience checking.
sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfigurationTests.java	Add tests validating single-tenant vs multi-tenant issuer validator wiring.
sdk/spring/CHANGELOG.md	Document the hardened defaults in changelog.

rujche · 2026-05-04T13:38:22Z

@copilot apply changes based on the comments in this thread

…pplication, fix changelog link Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-java/sessions/ac6fd8b6-366e-4630-bcaf-fee4ad6e62c3 Co-authored-by: rujche <171773178+rujche@users.noreply.github.com>

Copilot · 2026-05-04T13:48:10Z

@copilot apply changes based on the comments in this thread

Applied all three changes from the review thread in commit 3d2b4b46:

Import ordering (AadAuthenticationFilterTests.java): Moved ReflectionTestUtils import before the static imports block.
Centralized isMultiTenantsApplication (AadAuthenticationProperties): Changed the method to public static so it can be shared, and updated AadResourceServerConfiguration to call AadAuthenticationProperties.isMultiTenantsApplication(tenantId) — removing the duplicate private method.
CHANGELOG link (CHANGELOG.md): Fixed the label from [49032] to ([#49033](...)) to match the standard format.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

rujche · 2026-05-06T01:26:07Z

Ignore the test failure about java - spring - ci (Build Test ubuntu2404_121_NotFromSource_TestsOnly), it's a know issue: #48622

Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-java/sessions/bf7036ec-7fdf-46d5-8050-b72f537332d4 Co-authored-by: rujche <171773178+rujche@users.noreply.github.com>

…ationProperties Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-java/sessions/f49e9a93-8331-49f4-b8f0-2f78dbb7c32a Co-authored-by: rujche <171773178+rujche@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

rujche · 2026-05-07T04:58:12Z

@copilot apply changes based on the comments in this thread

rujche · 2026-05-07T05:19:36Z

@copilot apply changes based on the comments in this thread

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

…or.trustedIssuerRepoValidIssuer

rujche · 2026-05-07T06:06:37Z

@copilot apply changes based on the comments in this thread

rujche · 2026-05-07T06:11:02Z

@copilot apply changes based on the comments in this thread

…ion; add uppercase GUID test Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-java/sessions/065745e5-0b86-4d87-a559-fae10571fc21 Co-authored-by: rujche <171773178+rujche@users.noreply.github.com>

Copilot · 2026-05-07T06:14:24Z

@copilot apply changes based on the comments in this thread

Fixed in commit 6822bf79. getTrimmedTenantId() now applies .toLowerCase(Locale.ROOT) after .trim(), so an uppercase GUID in configuration is normalized before being used in the tid claim validator and AadTrustedIssuerRepository. A new test testValidateTenantIdNormalizesUppercaseGuid covers the uppercase GUID path.

Copilot · 2026-05-07T06:18:33Z

@copilot apply changes based on the comments in this thread

Fixed in commit 6822bf79c. getTrimmedTenantId() now applies .toLowerCase(Locale.ROOT) after .trim(), normalizing the configured tenant ID before it is used in the tid claim validator and AadTrustedIssuerRepository. A new test testValidateTenantIdNormalizesUppercaseGuid verifies that an uppercase GUID in configuration is normalized and accepted.

@copilot apply changes based on the comments in this thread

Fixed in commit 6822bf79c. getTrimmedTenantId() now applies .toLowerCase(Locale.ROOT) after .trim(), normalizing the configured tenant ID before it is used in the tid claim validator and AadTrustedIssuerRepository. A new test testValidateTenantIdNormalizesUppercaseGuid verifies that an uppercase GUID in configuration is normalized and accepted.

@copilot apply changes based on the comments in this thread

These changes were already applied in commit 6822bf79. getTrimmedTenantId() now normalizes via trim().toLowerCase(Locale.ROOT), and testValidateTenantIdNormalizesUppercaseGuid covers the uppercase GUID path.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

rujche added 2 commits May 4, 2026 12:35

Fix AAD issuer and audience validation defaults

a8bf37e

Update change log

a88077e

Copilot AI review requested due to automatic review settings May 4, 2026 04:39

rujche requested review from a team, Netyyyy, moarychan and saragluna as code owners May 4, 2026 04:39

rujche self-assigned this May 4, 2026

rujche added azure-spring All azure-spring related issues azure-spring-aad Spring active directory related issues. labels May 4, 2026

rujche added this to Spring Cloud Azure May 4, 2026

github-project-automation Bot moved this to Todo in Spring Cloud Azure May 4, 2026

rujche moved this from Todo to In Progress in Spring Cloud Azure May 4, 2026

rujche added this to the 2026-06 milestone May 4, 2026

Copilot AI reviewed May 4, 2026

View reviewed changes

Comment thread ...azure/spring/cloud/autoconfigure/implementation/aad/filter/AadAuthenticationFilterTests.java Outdated

Comment thread ...ing/cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfiguration.java Outdated

Comment thread sdk/spring/CHANGELOG.md Outdated

Copilot started work on behalf of rujche May 4, 2026 13:38 View session

Address review comments: fix import order, centralize isMultiTenantsA…

3d2b4b4

…pplication, fix changelog link Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-java/sessions/ac6fd8b6-366e-4630-bcaf-fee4ad6e62c3 Co-authored-by: rujche <171773178+rujche@users.noreply.github.com>

Copilot finished work on behalf of rujche May 4, 2026 13:49

rujche requested a review from Copilot May 6, 2026 01:20

Copilot started reviewing on behalf of rujche May 6, 2026 01:22 View session

Copilot AI reviewed May 6, 2026

View reviewed changes

Comment thread ...d/autoconfigure/implementation/aad/configuration/properties/AadAuthenticationProperties.java

Copilot started work on behalf of rujche May 6, 2026 01:28 View session

Revert isMultiTenantsApplication to private: not intended as public API

fc1af23

Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-java/sessions/bf7036ec-7fdf-46d5-8050-b72f537332d4 Co-authored-by: rujche <171773178+rujche@users.noreply.github.com>

Copilot finished work on behalf of rujche May 6, 2026 01:32

rujche commented May 6, 2026

View reviewed changes

Comment thread ...d/autoconfigure/implementation/aad/configuration/properties/AadAuthenticationProperties.java Outdated

Copilot started work on behalf of rujche May 6, 2026 02:21 View session

Revert static modifier from isMultiTenantsApplication in AadAuthentic…

5261f67

…ationProperties Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-java/sessions/f49e9a93-8331-49f4-b8f0-2f78dbb7c32a Co-authored-by: rujche <171773178+rujche@users.noreply.github.com>

Copilot started reviewing on behalf of rujche May 7, 2026 02:00 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread ...ing/cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfiguration.java Outdated

Comment thread .../azure/spring/cloud/autoconfigure/implementation/aad/security/jwt/AadJwtIssuerValidator.java

rujche requested a review from Copilot May 7, 2026 02:14

Copilot started reviewing on behalf of rujche May 7, 2026 02:15 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread ...ing/cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfiguration.java Outdated

Potential fix for pull request finding

50a21f8

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rujche requested a review from Copilot May 7, 2026 02:33

Copilot started reviewing on behalf of rujche May 7, 2026 02:35 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread ...ing/cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfiguration.java

Comment thread ...loud/autoconfigure/implementation/aad/configuration/AadResourceServerConfigurationTests.java

rujche requested a review from Copilot May 7, 2026 05:37

Copilot started reviewing on behalf of rujche May 7, 2026 05:39 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

Merge branch 'main' into rujche/main/fix-issue-in-AadJwtIssuerValidat…

b007f7c

…or.trustedIssuerRepoValidIssuer

Copilot started work on behalf of rujche May 7, 2026 06:11 View session

Normalize tenant ID to lowercase for case-insensitive tid/iss validat…

6822bf7

…ion; add uppercase GUID test Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-java/sessions/065745e5-0b86-4d87-a559-fae10571fc21 Co-authored-by: rujche <171773178+rujche@users.noreply.github.com>

Copilot finished work on behalf of rujche May 7, 2026 06:15

Copilot started work on behalf of rujche May 7, 2026 06:16 View session

Copilot finished work on behalf of rujche May 7, 2026 06:20

rujche requested a review from Copilot May 7, 2026 06:20

Copilot started reviewing on behalf of rujche May 7, 2026 06:22 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

rujche changed the title ~~Security: Enforce tenant-aware issuer validation and enable audience check by default for AAD authentication~~ Security improvements in Spring Cloud Azure AAD May 7, 2026

Copilot started work on behalf of rujche May 7, 2026 06:38 View session

Netyyyy approved these changes May 7, 2026

View reviewed changes

Conversation

rujche commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

All SDK Contribution checklist:

General Guidelines and Best Practices

Testing Guidelines

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rujche commented May 4, 2026

Uh oh!

Copilot AI commented May 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

rujche commented May 6, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

rujche commented May 7, 2026

Uh oh!

rujche commented May 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

rujche commented May 7, 2026

Uh oh!

rujche commented May 7, 2026

Uh oh!

Copilot AI commented May 7, 2026

Uh oh!

Copilot AI commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rujche commented May 4, 2026 •

edited

Loading

Copilot AI commented May 7, 2026 •

edited

Loading