-->![Secret Secret](/uploads/1/2/6/0/126017793/303661409.gif)
Java™ Platform
Standard Ed. 6 FRAMESNO FRAMESAll Classes SUMMARY: NESTED | FIELD | CONSTR | METHOD DETAIL: FIELD | CONSTR | METHOD
Submit a bug or feature
For further API reference and developer documentation, see Java SE Developer Documentation. That documentation contains more detailed, developer-targeted descriptions, with conceptual overviews, definitions of terms, workarounds, and working code examples.
- Key Generator
- Secret Key Generate Java Docs Free
- Free Keygens Downloads
- Key Generate Software
- Secret Key Generate Java Docs Download
Import java.security.Key; import javax.crypto.Cipher; import javax.crypto.KeyGenerator; import javax.crypto.SecretKey; import javax.crypto.SecretKeyFactory; import. Secret Key Generator. The Secret Key Generator step is used to create a random key, which can be used for symmetric encryption of data. The following sections describe the available options for configuring the Secret Key Generator step. Import java.security.Key; import javax.crypto.Cipher; import javax.crypto.KeyGenerator; import javax.crypto.SecretKey; import javax.crypto.SecretKeyFactory; import. Djecrety is a Django secret key generator. This is a web tool to generate SECRETKEY and also have a Django package that does this simply with a command. Djecrety Django Secret Key Generator.
When you create an application that needs access to secured services like the Office 365 Management APIs, you need to provide a way to let the service know if your application has rights to access it. The Office 365 Management APIs use Azure AD to provide authentication services that you can use to grant rights for your application to access them.
Key Generator
There are four key steps:
- Register your application in Azure AD. To allow your application access to the Office 365 Management APIs, you need to register your application in Azure AD. This allows you to establish an identity for your application and specify the permission levels it needs to access the APIs.
- Get Office 365 tenant admin consent. An Office 365 tenant admin must explicitly grant consent to allow your application to access their tenant data by means of the Office 365 Management APIs. The consent process is a browser-based experience that requires the tenant admin to sign in to the Azure AD consent UI and review the access permissions that your application is requesting, and then either grant or deny the request. After consent is granted, the UI redirects the user back to your application with an authorization code in the URL. Your application makes a service-to-service call to Azure AD to exchange this authorization code for an access token, which contains information about both the tenant admin and your application. The tenant ID must be extracted from the access token and stored for future use.
- Request access tokens from Azure AD. Using your application's credentials as configured in Azure AD, your application requests additional access tokens for a consented tenant on an ongoing basis, without the need for further tenant admin interaction. These access tokens are called app-only tokens because they do not include information about the tenant admin.
- Call the Office 365 Management APIs. The app-only access tokens are passed to the Office 365 Management APIs to authenticate and authorize your application.
The following diagram shows the sequence of consent and access token requests.
Important
Before you can access data through the Office 365 Management Activity API, you must enable unified audit logging for your Office 365 organization. You do this by turning on the Office 365 audit log. For instructions, see Turn Office 365 audit log search on or off.
Enabling unified audit logging isn't required if you're only using the Office 365 Service Communications API.
Enabling unified audit logging isn't required if you're only using the Office 365 Service Communications API.
Register your application in Azure AD
The Office 365 Management APIs use Azure AD to provide secure authentication to Office 365 tenant data. To access the Office 365 Management APIs, you need to register your app in Azure AD, and as part of the configuration, you will specify the permission levels your app needs to access the APIs.
Prerequisites
To register your app in Azure AD, you need a subscription to Office 365 and a subscription to Azure that has been associated with your Office 365 subscription. You can use trial subscriptions to both Office 365 and Azure to get started. For more details, see Welcome to the Office 365 Developer Program.
Use the Azure Management Portal to register your application in Azure AD
After you have a Microsoft tenant with the proper subscriptions, you can register your application in Azure AD.
- Sign into the Azure management portal, using the credential of your Microsoft tenant that has the subscription to Office 365 you wish to use. You can also access the Azure Management Portal via a link that appears in the left navigation pane in the Office admin portal.
- In the left navigation panel, choose Active Directory (1). Make sure the Directory tab (2) is selected, and then select the directory name (3).
- On the directory page, select Applications. Azure AD displays a list of the applications currently installed in your tenancy.
- Choose Add.
- Select Add an application my organization is developing.
- Enter the NAME of your application and specify the Type as WEB APPLICATION AND/OR WEB API.
- Enter the appropriate App properties:
- SIGN-ON URL. The URL where users can sign in and use your app. You can change this later as needed.
- APP ID URI. The URI used as a unique logical identifier for your app. The URI must be in a verified custom domain for an external user to grant your app access to their data in Windows Azure AD. For example, if your Microsoft tenant is contoso.onmicrosoft.com, the APP ID URI could be https://app.contoso.onmicrosoft.com.
- Your app is now registered with Azure AD, and has been assigned a client ID. However, there are several important aspects of your app left to configure.
Configure your application properties in Azure AD
Now that your application is registered, there are several important properties you must specify that determine how your application functions within Azure AD and how tenant admins will grant consent to allow your application to access their data by using the Office 365 Management APIs.
![Secret Secret](/uploads/1/2/6/0/126017793/303661409.gif)
For more information about Azure AD application configuration in general, see Application Object Properties.
- CLIENT ID. This value is automatically generated by Azure AD. Your application will use this value when requesting consent from tenant admins and when requesting app-only tokens from Azure AD.
- APPLICATION IS MULTI-TENANT. This property must be set to YES to allow tenant admins to grant consent to your app to access their data by using the Office 365 Management APIs. If this property is set to NO, your application will only be able to access your own tenant's data.
- REPLY URL. This is the URL that a tenant admin will be redirected to after granting consent to allow your application to access their data by using the Office 365 Management APIs. You can configure multiple reply URLs as needed. Azure automatically sets the first one to match the sign-on URL you specified when you created the application, but you can change this value as needed.
Be sure to choose Save after making any changes to these properties.
Generate a new key for your application
Keys, also known as client secrets, are used when exchanging an authorization code for an access token.
- In the Azure Management Portal, select your application and choose Configure in the top menu. Scroll down to keys.
- Select the duration for your key, and choose Save.
- Azure displays the app secret only after saving it. Select the Clipboard icon to copy the client secret to the Clipboard.ImportantAzure only displays the client secret at the time you initially generate it. You cannot navigate back to this page and retrieve the client secret later.
Configure an X.509 certificate to enable service-to-service calls
An application that is running in the background, such as a daemon or service, can use client credentials to request app-only access tokens without repeatedly requesting consent from the tenant admin after initial consent is granted.
For more information, see Service to Service Calls Using Client Credentials.
You must configure an X.509 certificate with your application to be used as client credentials when requesting app-only access tokens from Azure AD. There are two steps to the process:
- Obtain an X.509 certificate. You can use a self-signed certificate or a certificate issued by publicly trusted certificate authority.
- Modify your application manifest to include the thumbprint and public key of your certificate.
The following instructions show you how to use the Visual Studio or Windows SDK makecert tool to generate a self-signed certificate and export the public key to a base64-encoded file.
- From the command line, run the following:NoteWhen you are generating the X.509 certificate, make sure the key length is at least 2048. Shorter key lengths are not accepted as valid keys.
- Open the Certificates MMC snap-in and connect to your user account.
- Find the new certificate in the Personal folder and export the public key to a base64-encoded file (for example, mycompanyname.cer). Your application will use this certificate to communicate with Azure AD, so make sure you retain access to the private key as well.NoteYou can use Windows PowerShell to extract the thumbprint and base64-encoded public key. Other platforms provide similar tools to retrieve properties of certificates.
- From the Windows PowerShell prompt, type and run the following:
- Store the values for
$base64Thumbprint
,$base64Value
, and$keyid
to be used when you update your application manifest in the next set of steps.Using the values extracted from the certificate and the generated key ID, you must now update your application manifest in Azure AD. - In the Azure Management Portal, select your application and choose Configure in the top menu.
- In the command bar, choose Manage manifest, and then choose Download Manifest.
- Open the downloaded manifest for editing and replace the empty KeyCredentials property with the following JSON:NoteThe KeyCredentials property is a collection, making it possible to upload multiple X.509 certificates for rollover scenarios or delete certificates for compromise scenarios.
- Save your changes and upload the updated manifest by choosing Manage manifest in the command bar, choosing Upload manifest, browsing to your updated manifest file, and then selecting it.
Specify the permissions your app requires to access the Office 365 Management APIs
Finally, you need to specify exactly what permissions your app requires of the Office 365 Management APIs. To do so, you add access to the Office 365 Management APIs to your app, and then you specify the permission(s) you need.
- In the Azure Management Portal, select your application, and choose Configure in the top menu. Scroll down to permissions to other applications, and choose Add application.
- Select the Office 365 Management APIs (1) so that it appears in the Selected column (2), and then select the check mark in the lower right (3) to save your selection and return to the main configuration page for your application.
- The Office Management APIs now appear in the list of applications to which your application requires permissions. Under both Application Permissions and Delegated Permissions, select the permissions your application requires. Refer to the specific API reference for more details about each permission.NoteThere are currently four unused permissions related to activity reports and threat intelligence that will be removed in the future. Do not select any of these permissions because they are unnecessary.
- Choose Save to save the configuration.
Get Office 365 tenant admin consent
Now that your application is configured with the permissions it needs to use the Office 365 Management APIs, a tenant admin must explicitly grant your application these permissions in order to access their tenant's data by using the APIs. To grant consent, the tenant admin must sign in to Azure AD by using the following specially constructed URL, where they can review your application's requested permissions. This step is not required when using the APIs to access data from your own tenant.
The redirect URL must match or be a sub-path under one of the Reply URLs configured for your application in Azure AD.
For example:
You can test the consent URL by pasting it into a browser and signing in using the credentials of an Office 365 admin for a tenant other than the tenant that you used to register the application. You will see the request to grant your application permission to use the Office Management APIs.
After choosing Accept, you are redirected to the specified page, and there will be a code in the query string.
For example:
Your application uses this authorization code to obtain an access token from Azure AD, from which the tenant ID can be extracted. After you have extracted and stored the tenant ID, you can obtain subsequent access tokens without requiring the tenant admin to sign in.
Request access tokens from Azure AD
There are two methods for requesting access tokens from Azure AD:
- The Authorization Code Grant Flow involves a tenant admin granting explicit consent, which returns an authorization code to your application. Your application then exchanges the authorization code for an access token. This method is required to obtain the initial consent that your application needs to access the tenant data by using the API, and this first access token is needed in order to obtain and store the tenant ID.
- The Client Credentials Grant Flow allows your application to request subsequent access tokens as old ones expire, without requiring the tenant admin to sign in and explicitly grant consent. This method must be used for applications that run continuously in the background calling the APIs once the initial tenant admin consent has been granted.
Request an access token using the authorization code
After a tenant admin grants consent, your application receives an authorization code as a query string parameter when Azure AD redirects the tenant admin to your designated URL.
Your application makes an HTTP REST POST to Azure AD to exchange the authorization code for an access token. Because the tenant ID is not yet known, the POST will be to the 'common' endpoint, which does not have the tenant ID embedded in the URL:
The body of the POST contains the following:
Sample request
The body of the response will include several properties, including the access token.
Sample response
The access token that is returned is a JWT token that includes information about both the admin that granted consent and the application requesting access. The following shows an example of an un-encoded token. Your application must extract the tenant ID 'tid' from this token and store it so that it can be used to request additional access tokens as they expire, without further admin interaction.
Sample token
Request an access token by using client credentials
After the tenant ID is known, your application can make service-to-service calls to Azure AD to request additional access tokens as they expire. These tokens include information only about the requesting application and not about the admin that originally granted consent. Service-to-service calls require that your application use an X.509 certificate to create client assertion in the form of a base64-encoded, SHA256 signed JWT bearer token.
When you are developing your application in .NET, you can use the Azure AD Authentication Library (ADAL) to create client assertions. Other development platforms should have similar libraries.
An un-encoded JWT token consists of a header and payload that have the following properties.
Sample JWT token
The client assertion is then passed to Azure AD as part of a service-to-service call to request an access token. When using client credentials to request an access token, use an HTTP POST to a tenant-specific endpoint, where the previously extracted and stored tenant ID is embedded in the URL.
The body of the POST contains the following:
Sample request
The response will be the same as before, but the token will not have the same properties, because it does not contain properties of the admin that granted consent.
Sample response
Sample access token
Build your app
Now that you have registered your app in Azure AD and configured it with the necessary permissions, you're ready to build your app. The following are some of the key aspects to consider when designing and building your app:
- The consent experience. To obtain consent from your customers, you must direct them in a browser to the Azure AD website, using the specially constructed URL described previously, and you must have a website to which Azure AD will redirect the admin once they grant consent. This website must extract the authorization code from the URL and use it to request an access token from which it can obtain the tenant ID.
- Store the tenant ID in your system. This will be needed when requesting access tokens from Azure AD and when calling the Office Management APIs.
- Managing access tokens. You will need a component that requests and manages access tokens as needed. If your app calls the APIs periodically, it can request tokens on demand, or if it calls the APIs continuously to retrieve data, it can request tokens at regular intervals (for example, every 45 minutes).
- Implement a webhook listener as needed by the particular API you are using.
- Data retrieval and storage. You'll need a component that retrieves data for each tenant, either by using continuous polling or in response to webhook notifications, depending on the particular API you are using.
This class provides the functionality of a secret (symmetric) key generator.
Key generators are constructed using one of the
getInstance
class methods of this class. KeyGenerator objects are reusable, i.e., after a key has been generated, the same KeyGenerator object can be re-used to generate further keys.
There are two ways to generate a key: in an algorithm-independent manner, and in an algorithm-specific manner. The only difference between the two is the initialization of the object:
- Algorithm-Independent InitializationAll key generators share the concepts of a keysize and a source of randomness. There is an
init
method in this KeyGenerator class that takes these two universally shared types of arguments. There is also one that takes just akeysize
argument, and uses the SecureRandom implementation of the highest-priority installed provider as the source of randomness (or a system-provided source of randomness if none of the installed providers supply a SecureRandom implementation), and one that takes just a source of randomness.Since no other parameters are specified when you call the above algorithm-independentinit
methods, it is up to the provider what to do about the algorithm-specific parameters (if any) to be associated with each of the keys. - Algorithm-Specific InitializationFor situations where a set of algorithm-specific parameters already exists, there are two
init
methods that have anAlgorithmParameterSpec
argument. One also has aSecureRandom
argument, while the other uses the SecureRandom implementation of the highest-priority installed provider as the source of randomness (or a system-provided source of randomness if none of the installed providers supply a SecureRandom implementation).
In case the client does not explicitly initialize the KeyGenerator (via a call to an
init
method), each provider must supply (and document) a default initialization.- Since:
- 1.4
- See Also:
SecretKey
Constructor Summary | |
---|---|
protected | KeyGenerator(KeyGeneratorSpi keyGenSpi, Provider provider, String algorithm) Creates a KeyGenerator object. |
Method Summary | |
---|---|
SecretKey | generateKey() Generates a secret key. |
String | getAlgorithm() Returns the algorithm name of this KeyGenerator object. |
static KeyGenerator | getInstance(String algorithm) Returns a KeyGenerator object that generates secret keys for the specified algorithm. |
static KeyGenerator | getInstance(String algorithm, Provider provider) Returns a KeyGenerator object that generates secret keys for the specified algorithm. |
static KeyGenerator | getInstance(String algorithm, String provider) Returns a KeyGenerator object that generates secret keys for the specified algorithm. |
Provider | getProvider() Returns the provider of this KeyGenerator object. |
void | init(AlgorithmParameterSpec params) Initializes this key generator with the specified parameter set. |
void | init(AlgorithmParameterSpec params, SecureRandom random) Initializes this key generator with the specified parameter set and a user-provided source of randomness. |
void | init(int keysize) Initializes this key generator for a certain keysize. |
void | init(int keysize, SecureRandom random) Initializes this key generator for a certain keysize, using a user-provided source of randomness. |
void | init(SecureRandom random) Initializes this key generator. |
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Constructor Detail |
---|
KeyGenerator
- Creates a KeyGenerator object.
- Parameters:
keyGenSpi
- the delegateprovider
- the provideralgorithm
- the algorithm
Method Detail |
---|
getAlgorithm
Returns the algorithm name of thisKeyGenerator
object. This is the same name that was specified in one of the
getInstance
calls that created this KeyGenerator
object.- Returns:
- the algorithm name of this
KeyGenerator
object.
getInstance
Returns aKeyGenerator
object that generates secret keys for the specified algorithm. Secret Key Generate Java Docs Free
This method traverses the list of registered security Providers, starting with the most preferred Provider. A new KeyGenerator object encapsulating the KeyGeneratorSpi implementation from the first Provider that supports the specified algorithm is returned.
Note that the list of registered providers may be retrieved via the
Security.getProviders()
method.- Parameters:
algorithm
- the standard name of the requested key algorithm. See Appendix A in the Java Cryptography Architecture Reference Guide for information about standard algorithm names.- Returns:
- the new
KeyGenerator
object. - Throws:
NullPointerException
- if the specified algorithm is null.NoSuchAlgorithmException
- if no Provider supports a KeyGeneratorSpi implementation for the specified algorithm.- See Also:
Provider
getInstance
Returns aKeyGenerator
object that generates secret keys for the specified algorithm. Free Keygens Downloads
A new KeyGenerator object encapsulating the KeyGeneratorSpi implementation from the specified provider is returned. The specified provider must be registered in the security provider list.
Note that the list of registered providers may be retrieved via the
Security.getProviders()
method.- Parameters:
algorithm
- the standard name of the requested key algorithm. See Appendix A in the Java Cryptography Architecture Reference Guide for information about standard algorithm names.provider
- the name of the provider.- Returns:
- the new
KeyGenerator
object. - Throws:
NullPointerException
- if the specified algorithm is null.NoSuchAlgorithmException
- if a KeyGeneratorSpi implementation for the specified algorithm is not available from the specified provider.NoSuchProviderException
- if the specified provider is not registered in the security provider list.IllegalArgumentException
- if theprovider
is null or empty.- See Also:
Provider
getInstance
Returns aKeyGenerator
object that generates secret keys for the specified algorithm. A new KeyGenerator object encapsulating the KeyGeneratorSpi implementation from the specified Provider object is returned. Note that the specified Provider object does not have to be registered in the provider list.
- Parameters:
algorithm
- the standard name of the requested key algorithm. See Appendix A in the Java Cryptography Architecture Reference Guide for information about standard algorithm names.provider
- the provider.- Returns:
- the new
KeyGenerator
object. - Throws:
NullPointerException
- if the specified algorithm is null.NoSuchAlgorithmException
- if a KeyGeneratorSpi implementation for the specified algorithm is not available from the specified Provider object.IllegalArgumentException
- if theprovider
is null.- See Also:
Provider
getProvider
- Returns the provider of this
KeyGenerator
object. - Returns:
- the provider of this
KeyGenerator
object
init
- Initializes this key generator.
- Parameters:
random
- the source of randomness for this generator
Key Generate Software
init
Initializes this key generator with the specified parameter set. If this key generator requires any random bytes, it will get them using the
SecureRandom
implementation of the highest-priority installed provider as the source of randomness. (If none of the installed providers supply an implementation of SecureRandom, a system-provided source of randomness will be used.)- Parameters:
params
- the key generation parameters- Throws:
InvalidAlgorithmParameterException
- if the given parameters are inappropriate for this key generator
Secret Key Generate Java Docs Download
init
- Initializes this key generator with the specified parameter set and a user-provided source of randomness.
- Parameters:
params
- the key generation parametersrandom
- the source of randomness for this key generator- Throws:
InvalidAlgorithmParameterException
- ifparams
is inappropriate for this key generator
init
Initializes this key generator for a certain keysize. If this key generator requires any random bytes, it will get them using the
SecureRandom
implementation of the highest-priority installed provider as the source of randomness. (If none of the installed providers supply an implementation of SecureRandom, a system-provided source of randomness will be used.)- Parameters:
keysize
- the keysize. This is an algorithm-specific metric, specified in number of bits.- Throws:
InvalidParameterException
- if the keysize is wrong or not supported.
init
- Initializes this key generator for a certain keysize, using a user-provided source of randomness.
- Parameters:
keysize
- the keysize. This is an algorithm-specific metric, specified in number of bits.random
- the source of randomness for this key generator- Throws:
InvalidParameterException
- if the keysize is wrong or not supported.
generateKey
- Generates a secret key.
- Returns:
- the new key
Overview | Package | Class | Use | Tree | Deprecated | Index | Help |
Standard Ed. 6
For further API reference and developer documentation, see Java SE Developer Documentation. That documentation contains more detailed, developer-targeted descriptions, with conceptual overviews, definitions of terms, workarounds, and working code examples.
Copyright © 1993, 2011, Oracle and/or its affiliates. All rights reserved.