How to authenticate, with azure devops services, using SAML via on premise standalone java application?

Question

We have a network where azure DevOps services can be used by logging in via SAML. There is an independent java application in that same network.

Can anyone please point out a way that this java application can get authenticated to Azure DevOps services via SAML, without any manual intervention?

PS: I've explored a lot of blogs but I couldn't find what I need specifically. Closest I got, was to register my java application as a AD tenant, but in our use case this can't be done.

Is there any other alternative? Please suggest.

Answer 1

There is a fairly sizable range of authentication options, based upon what you have said you are looking for a non-interactive login which rules out some options, and leaves the following:

• Device Profile - probably not ideal for you given you would need to find a way to this in Java as the examples are few and far between and mostly written in C#.
• TFS Application - again not ideal given you would need to either find someone who has written a 3rd party client library for Java or write one yourself.
• Azure DevOps Extension - while you could write an Azure DevOps extension, and use that to access Azure DevOps it's a lot of work and potentially would expose security issues.

Given that we have probably ruled out non-interactive login to Azure DevOps you could also explore one of the two following options:

• Interactive Logins - is there an option in your environment from forcing the user to authenticate with Azure DevOps using OAuth then capture the token for non-interactive use? This is quite a common pattern with GitHub, GitLab and Bitbucket.
• Personal Access Tokens - mostly this would be abusing a feature of Azure DevOps as these are designed for users not applications, although it could work in your constrained environment.
• Non-interactive Login using your Identity Provider - you haven't detailed who your Identity Provider is, but it is possible it supports authentication using Client Certificates, Shared Secrets, etc. which would give you a SAML token which could be exchanged for an Azure DevOps Access token.

Hope those help.