Using OAuth 2.0 Authorization with a Certificate in SSIS

10 December 2019
Chen Huang

In previous posts, we discussed working with various OAuth 2.0 grant types in SSIS by utilizing our OAuth Token Generator (offered in our SSIS Productivity Pack).

In this post, we delve into getting an OAuth 2.0 access token with a certificate in SSIS. This will be a step-by-step demonstration on how to generate the JSON Web Token (JWT) assertion and use that JWT assertion to get the OAuth2 access token. We will be using Microsoft Graph API as an example for this blog.

Prerequisites

  1. You need to register an Azure AD application and set the appropriate permission for the app.
  2. You need to register your certificate with Azure AD. Please refer to this link for more details.

Get Token in SSIS

Before we get started in generating the token in OAuth Token Generator, let’s first take a look at the Microsoft documentation of getting an access token with a certificate.

Documentation (Link)

Endpoint: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Parameters:

  • Tenant: The directory tenant the application plans to operate against, in GUID or domain-name format.
  • Client_id: The application (client) ID of the AAD app.
  • Scope: The value passed for the scope parameter in this request should be the resource identifier (application ID URI) of the resource you want.
  • Client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer.
  • client_assertion: An assertion (a JWT) that you need to create and sign with the certificate you registered as credentials for your application.
  • Grant_type: client_credentials

Once you have the Microsoft AAD app registered and configured, you should be able to get all the required information to put into the OAuth Token Generator as shown below:

OAuth Token Generator - General Setting

Click Next to go to the next page and click the Edit Body to edit the Request Body to specify the additional parameters – client_assertion and client_assertion_type.

To create the client_assertion, we need to enable the “Client Assertion” option in the Edit Body page. Let’s have a look at how to format the assertion.

Documentation (Link)

Parameters:

  • Aud: Audience: Should be https://login.microsoftonline.com/*tenant_Id*/oauth2/token
  • Iss: Issuer: should be the client_id (Application ID of the client service)
  • Sub: Subject: As for iss, should be the client_id (Application ID of the client service)

Based on the documentation, we configure the OAuth Token Generator as follows:

OAuth Token Generator - Edit Body

Note in the Certificate Thumbprint option, we specify the thumbprint of the public certificate that we have uploaded to the Microsoft AAD application. Please make sure you have installed the corresponding Private Key file on the machine where HTTP Connection Manager/OAuth Token Generator is used.

Once done with Edit Body, fill the Request Token URL and click the Get Tokens button to get access_token from the endpoint.

OAuth Token Generator - Get Token

The OAuth Token Generator will ask you to save the token once the access_token is successfully retrieved.

Conclusion

In this blog, we went through the JWT assertion OAuth2 authentication with a certificate and demonstrated the process of working with an OAuth2 authentication workflow in SSIS by using OAuth Token Generator found in our SSIS Productivity Pack. We hope this can help you speed up your SSIS development when working with OAuth 2.0 authentication.

comments powered by Disqus