From 26506307d8f2d01e0c886921515d313736ee6969 Mon Sep 17 00:00:00 2001 From: Rajkumar Rangaraj Date: Wed, 11 Nov 2026 16:02:53 -0800 Subject: [PATCH 1/2] Support TenantId and AuthorityHost in APPLICATIONINSIGHTS_AUTHENTICATION_STRING Client secret authentication configured via APPLICATIONINSIGHTS_AUTHENTICATION_STRING always failed validation because there was no way to provide the tenant id. Fixes #4891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 6 ++++ .../internal/configuration/Configuration.java | 5 ++- .../configuration/ConfigurationBuilder.java | 7 ++++- .../configuration/ConfigurationTest.java | 31 +++++++++++++++++++ 4 files changed, 47 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1cfba585e3..007062c918 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ ## Unreleased +### Bug fixes + +* Support `TenantId` and `AuthorityHost` in `APPLICATIONINSIGHTS_AUTHENTICATION_STRING` so that + client secret authentication configured via the environment variable can work + ([#4891](https://github.com/microsoft/ApplicationInsights-Java/issues/4891)) + ## Version 3.7.10 GA (09/17/2026) ### Enhancements diff --git a/agent/agent-tooling/src/main/java/com/microsoft/applicationinsights/agent/internal/configuration/Configuration.java b/agent/agent-tooling/src/main/java/com/microsoft/applicationinsights/agent/internal/configuration/Configuration.java index 877e12b97a..2db2e6bc29 100644 --- a/agent/agent-tooling/src/main/java/com/microsoft/applicationinsights/agent/internal/configuration/Configuration.java +++ b/agent/agent-tooling/src/main/java/com/microsoft/applicationinsights/agent/internal/configuration/Configuration.java @@ -1619,7 +1619,8 @@ public void validate() { if (isEmpty(tenantId)) { throw new FriendlyException( "AAD Authentication configuration of type Client Secret Identity is missing \"tenantId\".", - "Please provide a valid \"tenantId\" under the \"authentication\" configuration. " + "Please provide a valid \"tenantId\" under the \"authentication\" configuration, " + + "or add \"TenantId={TENANT_ID}\" to the APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable. " + "Learn more about authentication configuration here: https://docs.microsoft.com/en-us/azure/azure-monitor/app/java-standalone-config#authentication"); } @@ -1639,6 +1640,8 @@ public enum AuthenticationType { SAMI, // APPLICATIONINSIGHTS_AUTHENTICATION_STRING=Authorization=AAD, @Deprecated VSCODE, + // APPLICATIONINSIGHTS_AUTHENTICATION_STRING=Authorization=AAD;ClientId={CLIENT_ID}; + // ClientSecret={CLIENT_SECRET};TenantId={TENANT_ID}[;AuthorityHost={AUTHORITY_HOST}] @Deprecated CLIENTSECRET } diff --git a/agent/agent-tooling/src/main/java/com/microsoft/applicationinsights/agent/internal/configuration/ConfigurationBuilder.java b/agent/agent-tooling/src/main/java/com/microsoft/applicationinsights/agent/internal/configuration/ConfigurationBuilder.java index 93e4cb90af..c1da74cb6f 100644 --- a/agent/agent-tooling/src/main/java/com/microsoft/applicationinsights/agent/internal/configuration/ConfigurationBuilder.java +++ b/agent/agent-tooling/src/main/java/com/microsoft/applicationinsights/agent/internal/configuration/ConfigurationBuilder.java @@ -275,7 +275,7 @@ private static void logConfigurationWarnings(Configuration config) { configurationLogger.warn( "\"clientsecret\" json configuration has been deprecated since 3.5.0 GA. Please use \"user-assigned managed identity\" or \"system-assigned managed identity\" instead. " + "If you're on premise, you can use APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable to pass the client ID and secret, " - + "e.g. APPLICATIONINSIGHTS_AUTHENTICATION_STRING=Authorization=AAD;ClientId={CLIENT_ID};ClientSecret={CLIENT_SECRET}."); + + "e.g. APPLICATIONINSIGHTS_AUTHENTICATION_STRING=Authorization=AAD;ClientId={CLIENT_ID};ClientSecret={CLIENT_SECRET};TenantId={TENANT_ID}."); } if (config.sampling.requestsPerSecond != null && config.sampling.percentage != null) { configurationLogger.warn( @@ -516,6 +516,11 @@ private static void overlayAadEnvVars( // Override type to Client Secret config.authentication.type = Configuration.AuthenticationType.CLIENTSECRET; config.authentication.clientSecret = clientSecret; + config.authentication.tenantId = keyValueMap.get("TenantId"); + String authorityHost = keyValueMap.get("AuthorityHost"); + if (authorityHost != null && !authorityHost.isEmpty()) { + config.authentication.authorityHost = authorityHost; + } } else { // Override type to User Assigned Managed Identity config.authentication.type = Configuration.AuthenticationType.UAMI; diff --git a/agent/agent-tooling/src/test/java/com/microsoft/applicationinsights/agent/internal/configuration/ConfigurationTest.java b/agent/agent-tooling/src/test/java/com/microsoft/applicationinsights/agent/internal/configuration/ConfigurationTest.java index 829afe4cd2..35b7bc894b 100644 --- a/agent/agent-tooling/src/test/java/com/microsoft/applicationinsights/agent/internal/configuration/ConfigurationTest.java +++ b/agent/agent-tooling/src/test/java/com/microsoft/applicationinsights/agent/internal/configuration/ConfigurationTest.java @@ -10,6 +10,7 @@ import com.fasterxml.jackson.databind.DeserializationFeature; import com.fasterxml.jackson.databind.ObjectMapper; import com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException; +import com.microsoft.applicationinsights.agent.internal.common.FriendlyException; import com.microsoft.applicationinsights.agent.internal.configuration.Configuration.JmxMetric; import com.microsoft.applicationinsights.agent.internal.configuration.Configuration.MatchType; import com.microsoft.applicationinsights.agent.internal.configuration.Configuration.PreviewConfiguration; @@ -705,6 +706,36 @@ void shouldOverrideAadAuthenticationConfig() throws IOException { .isEqualTo(Configuration.AuthenticationType.CLIENTSECRET); assertThat(configuration3.authentication.clientId).isEqualTo("12345678"); assertThat(configuration3.authentication.clientSecret).isEqualTo("clientsecret123"); + assertThat(configuration3.authentication.tenantId).isNull(); + assertThatThrownBy(configuration3.authentication::validate) + .isInstanceOf(FriendlyException.class) + .hasMessageContaining("missing \"tenantId\""); + + envVars.put( + "APPLICATIONINSIGHTS_AUTHENTICATION_STRING", + "Authorization=AAD;ClientId=12345678;ClientSecret=clientsecret123;TenantId=tenant123"); + Configuration configuration4 = loadConfiguration("applicationinsights_aadauthenv.json"); + ConfigurationBuilder.overlayFromEnv( + configuration4, Paths.get("."), this::envVars, this::systemProperties); + assertThat(configuration4.authentication.type) + .isEqualTo(Configuration.AuthenticationType.CLIENTSECRET); + assertThat(configuration4.authentication.clientId).isEqualTo("12345678"); + assertThat(configuration4.authentication.clientSecret).isEqualTo("clientsecret123"); + assertThat(configuration4.authentication.tenantId).isEqualTo("tenant123"); + assertThat(configuration4.authentication.authorityHost).isNull(); + configuration4.authentication.validate(); + + envVars.put( + "APPLICATIONINSIGHTS_AUTHENTICATION_STRING", + "Authorization=AAD;ClientId=12345678;ClientSecret=clientsecret123;TenantId=tenant123;" + + "AuthorityHost=https://login.microsoftonline.us/"); + Configuration configuration5 = loadConfiguration("applicationinsights_aadauthenv.json"); + ConfigurationBuilder.overlayFromEnv( + configuration5, Paths.get("."), this::envVars, this::systemProperties); + assertThat(configuration5.authentication.tenantId).isEqualTo("tenant123"); + assertThat(configuration5.authentication.authorityHost) + .isEqualTo("https://login.microsoftonline.us/"); + configuration5.authentication.validate(); } @Test From 44be1219181e6cb618377bfc275130f94160c43d Mon Sep 17 00:00:00 2001 From: Rajkumar Rangaraj Date: Wed, 11 Nov 2026 16:03:15 -0800 Subject: [PATCH 2/2] Link changelog entry to PR Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 007062c918..70f7e95801 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,7 @@ * Support `TenantId` and `AuthorityHost` in `APPLICATIONINSIGHTS_AUTHENTICATION_STRING` so that client secret authentication configured via the environment variable can work - ([#4891](https://github.com/microsoft/ApplicationInsights-Java/issues/4891)) + ([#4892](https://github.com/microsoft/ApplicationInsights-Java/pull/4892)) ## Version 3.7.10 GA (09/17/2026)