(Node.js) Azure Key Vault Get OAuth2 Access Token using Client Credentials

See more Azure Key Vault Examples

Demonstrates how to get an OAuth2 access token using client credentials for an Azure Key Vault resource.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOSX, and ARM

var os = require('os');
if (os.platform() == 'win32') {  
    if (os.arch() == 'ia32') {
        var chilkat = require('@chilkat/ck-node21-win-ia32');
    } else {
        var chilkat = require('@chilkat/ck-node21-win64'); 
    }
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node21-arm');
    } else if (os.arch() == 'x86') {
        var chilkat = require('@chilkat/ck-node21-linux32');
    } else {
        var chilkat = require('@chilkat/ck-node21-linux64');
    }
} else if (os.platform() == 'darwin') {
    if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node21-mac-m1');
    } else {
        var chilkat = require('@chilkat/ck-node21-macosx');
    }
}

function chilkatExample() {

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // You can use OAuth2 client credentials with an Azure App (service principal) that has
    // the required Role-Based Access Control (RBAC) permissions.
    // In this case, it would be service principal with RBAC permissions to administer and manage
    // the key vault.

    // You can create the Azure App (also known as the Service Principal)
    // in the Azure CLI (command line interface) as follows:

    // ----------------------------------------------------------------------
    // az ad sp create-for-rbac --name http://example.com --role Contributor
    // ----------------------------------------------------------------------

    // The argument to --name must be a valid URI that is a verified domain of your 
    // organization or its subdomain.

    // The output of the above "az ad sp create-for-rbac ..." command is JSON such as this:

    // {
    //   "appId": "25ac6e3a-9ac7-42b9-b13e-18644c1de959",
    //   "displayName": "azure-cli-2023-10-14-22-38-15",
    //   "name": "http://example.com",
    //   "password": "f1f2f3f0-52dc-4236-8295-c8a1d6aa393c",
    //   "tenant": "4d8dfd66-68d1-13b0-af5c-b31b4b3d53d"
    // }

    // Save the values in the above JSON.  You'll need it below..

    // You'll also want to add the role of "Key Vault Administrator" to the Service Principal
    // for the particular key vault.

    // ----------------------------------------------------------------------
    // az role assignment create --assignee <Application-ID> --role "Key Vault Administrator" 
    //       --scope /subscriptions/<Subscription-ID>/resourceGroups/<Resource-Group-Name>/providers/Microsoft.KeyVault/vaults/<KeyVault-Name>
    // ----------------------------------------------------------------------

    var http = new chilkat.Http();
    var req = new chilkat.HttpRequest();

    // Add query params to the request.
    req.AddParam("grant_type","client_credentials");

    // Use the service principal's appId
    req.AddParam("client_id","25ac6e3a-9ac7-42b9-b13e-18644c1de959");

    // Use the service principal's password.
    req.AddParam("client_secret","f1f2f3f0-52dc-4236-8295-c8a1d6aa393c");

    // Note: The resource must match the API for which you're using the access token..
    req.AddParam("resource","https://vault.azure.net");

    http.SetUrlVar("tenant","4d8dfd66-68d1-13b0-af5c-b31b4b3d53d");
    // resp: HttpResponse
    var resp = http.PostUrlEncoded("https://login.microsoftonline.com/{$tenant}/oauth2/token",req);
    if (http.LastMethodSuccess !== true) {
        console.log(http.LastErrorText);
        return;
    }

    var strRespBody = resp.BodyStr;
    var respStatusCode = resp.StatusCode;
    if (respStatusCode >= 400) {
        console.log("Response Status Code = " + respStatusCode);
        console.log("Response Body:");
        console.log(strRespBody);

        return;
    }

    var jsonResp = new chilkat.JsonObject();
    jsonResp.Load(strRespBody);
    jsonResp.EmitCompact = false;
    console.log(jsonResp.Emit());

    // The result is an access token such as the following:

    // {
    //   "token_type": "Bearer",
    //   "expires_in": "3600",
    //   "ext_expires_in": "3600",
    //   "expires_on": "1557864616",
    //   "not_before": "1557860716",
    //   "resource": "https://vault.azure.net",
    //   "access_token": "eyJ0eXAiOiJKV1QiL ... 20UFDDOHEyUg"
    // }

    // If you wish, you can save the token to a file.
    // The access token is generally valid for 1 hour.
    // After 1 hour, you would need to get a new access token in the same way.
    jsonResp.WriteFile("qa_data/tokens/azureKeyVaultToken.json");


}

chilkatExample();