Can the team please review the Azure SDK Guidelines for Java Libraries, and identify what needs to be addressed to bring consistency with the other Azure SDKs already published on Maven Central?

// @JonathanGiles

If execute the sample from power shell like:

java -jar <JAR_FILE> works ok

But if execute the same jar file as a windows service I can't recover the same credentials.

What is the problem?

Thanks for implementing this library, it's really useful! 🎉

I have bumped into a small issue while using it on Mac: if the username or the password contains any special characters, they are not stored and retrieved correctly. E.g. if I store the username "täst", it retrieves this string: 0x74C3A47374 "t\303\244st

My macOS version is Sonoma 14.0.

Here is the code that I use to store the credentials:

fun storeAccount(accountKey: String, urlKey: String, settings: ServerConfiguration) {
    val credentialStorage = StorageProvider.getCredentialStorage(true, StorageProvider.SecureOption.REQUIRED)
    val storedSettings = Settings()

    if (settings.url.isEmpty()) {
        storedSettings.remove(urlKey)
        credentialStorage.delete(accountKey)
        return
    }

    storedSettings.putString(urlKey, settings.url)
    if (settings.username.isEmpty()) {
        credentialStorage.delete(accountKey)
        return
    }

    val credentialsToStore = StoredCredential(settings.username, settings.password.toCharArray())
    credentialStorage.add(accountKey, credentialsToStore)
}

This is used to load them:

fun getAccount(accountKey: String, urlKey: String): ServerConfiguration {
    val storedSettings = Settings()
    val url = storedSettings.getString(urlKey, "")
    val credentialStorage = StorageProvider.getCredentialStorage(true, StorageProvider.SecureOption.REQUIRED)
    val credential: StoredCredential? = credentialStorage.get(accountKey)
    val username = credential?.username ?: ""
    val password = (credential?.password ?: CharArray(0)).joinToString("")
    return ServerConfiguration(url, username, password)
}

I also tested on Windows and there it worked without issues. (Not sure about Linux as I didn't manage to get it running at all due to some strange NPEs, I'm still looking into that.)

StoredSecret interface looks like a good candidate to be AutoCloseable. So instead of this abomination from the sample code

private void userLogin() {
    log.info("Authenticating a user");

    final StoredCredential enteredCredential = enterCredentials();
    StoredCredential storedCredential = null;

    try {
        // Save the credential to the store.
        storedCredential = credentialStorage.get(CREDENTIALS_KEY);

        if (storedCredential.equals(enteredCredential)) {
            log.info("User logged in successfully.");
        } else {
            log.info("Authentication failed.");
        }
    } finally {
        // clear password value
        enteredCredential.clear();

        if (storedCredential != null) {
            storedCredential.clear();
        }
    }
}

you could write this beauty

private void userLogin() {
    log.info("Authenticating a user");

    try (StoredCredential enteredCredential = enterCredentials();
         StoredCredential storedCredential = credentialStorage.get(CREDENTIALS_KEY)) {

        if (storedCredential.equals(enteredCredential)) {
            log.info("User logged in successfully.");
        } else {
            log.info("Authentication failed.");
        }
    }
}

Is this project still maintained?

I'm glad to see this was extracted from https://github.com/microsoft/vsts-authentication-library-for-java but there haven't been updates since Mar. last year.

The following code throws a NullPointerException if an empty string ("") is used for username. The code works fine if a non-empty string is used. Tested on Windows 10 using OpenJDK 15 only.

Expected behavior would be eighter:
a) Don't accept "" in StoredCredential constructor
b) (preferred) Don't throw an exception during store.get() to enable storing passwords/secrets without a username.

com.microsoft.credentialstorage.SecretStore<StoredCredential> store = StorageProvider.getCredentialStorage(true, StorageProvider.SecureOption.REQUIRED);
String username = "";
store.add("dummy", new StoredCredential(username, "xxx".toCharArray()));
try {
    store.get("dummy");
} catch (Exception e) {
    e.printStackTrace();
}