Sign In with Microsoft Entra ID (Azure AD) from Java

We moved from Google SSO to Microsoft 365 / Entra ID sign-in. Notes from that migration: Configure in the Microsoft Entra admin center:

https://entra.microsoft.com

I’ll skip the Entra admin-center wizard and focus on what we wired into the Java services.

Microsoft publishes sample code on GitHub:

https://learn.microsoft.com/en-us/entra/identity-platform/sample-v2-code?tabs=apptype

https://github.com/Azure-Samples/ms-identity-msal-java-samples/tree/main/3-java-servlet-web-app/1-Authentication/sign-in

The README for the sample that matched my case required JDK 8 (and as I recall Tomcat 8 or higher as well). Some legacy systems still used JDK 1.6 with Tomcat 7, so we used this older sample instead:

https://github.com/Azure-Samples/active-directory-java-webapp-openidconnect/tree/master

Current samples use MSAL via msal4j.jar; some legacy apps use ADAL via adal4j.jar. Bottom line: ADAL still worked fine for M365 login. (MSAL is the renewed ADAL; Microsoft recommends moving to MSAL.)

MSAL samples are written for Spring Boot, so following the README was straightforward. Systems that had to stay on ADAL sometimes did not even use Maven, so I copied the required JARs from the sample into the project one by one.

Flow: obtain a token from Azure, then call Graph for user information.

For ADAL, follow the README: register the filter class from the sample and put the tenant ID and related Entra settings into web.xml.

The parts I edited myself:

• Added a few fields to the User DTO that holds user info
• In BasicFilter (the filter/interceptor on every request), adjusted the scope to match Entra settings:

+ "/oauth2/authorize?response_type=code&scope=directory.read.all&response_mode=form_post&redirect_uri="

Finally, in AadController (wired via web.xml), without selecting fields Graph returns a lot of unused values, so I limited the URL to what we need:

URL url = new URL("https://graph.microsoft.com/v1.0/users?$select=id,displayName,companyName,department,preferredLanguage,userPrincipalName,mail,onPremisesSamAccountName");

Field selection docs:

https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http

I plan to post about LDAP authentication integration next.