[QUERY] Support needed setting up client credential flow with Spring Boot app

[BillyBolton]

Query/Question
Question also posted on StackOverflow here.

I'm trying to setup client credential flow with a Spring app to access a web api (both owned by myself). I've attempted to follow the Azure documentation Microsoft identity platform and the OAuth 2.0 client credentials flow and Quickstart: Configure a client application to access a web API but I'm running into a few problems because the documentation is not clear. Somewhere in my setup, Azure is forcing the user to sign-in, and then other error messages sprout from there. As we know, however, client credential should be machine to machine authorization so I'm not sure why this sign-in flow is happening.

Below are some photos of my setup from Azure and the applications.yml file. Any feedback would be helpful getting me up running.

application.yml

 azure:
  activedirectory:
    tenant-id: {my-web-app-tenant-id}
    client-id: {my-web-app-client-id}
    client-secret: {my-web-app-client-secret}
    authorization-clients:
     web-api:
       scopes:
         - api://example-api/Employees.Read.All
         - api://example-api/Employees.Write.All

Why is this not a Bug or a feature Request?
A clear explanation of why is this not a bug or a feature request?

Setup (please complete the following information if applicable):

• OS: Ubuntu 20.10
• IDE: Visual Studio Code
• Library/Libraries:
• com.azure.spring:azure-spring-boot-starter-active-directory:3.5.0
• org.springframework.boot:spring-boot-starter-oauth2-client

Information Checklist
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

• Query Added
• Setup information Added

[joshfree]

Hi @BillyBolton, someone from the azure-spring team will follow up with you shortly.

/cc @stliu

[BillyBolton]

Update:
From the steps here, I was able to get the token I wanted using Postman. The missing step was to make an App Role from the api, and then use application permissions for that role on the client side.

Unfortunately, I'm still getting the same sign-in flow though, which makes me think there's an issue on the Spring boot configuration. Would you be able to clarify what the applications.yml file needs to look like for this flow? (I've been looking at the documentation and it's really not clear).

 azure:
  activedirectory:
    tenant-id: {my-web-app-tenant-id}
    client-id: {my-web-app-client-id}
    client-secret: {my-web-app-client-secret}
    authorization-clients:
     web-api:
       scopes:
         - api://example-api/.default