Skip to content

Enable JVM proxy system properties in Key Vault JCA HTTP client#49316

Open
waiet wants to merge 3 commits into
Azure:mainfrom
waiet:codex/keyvault-jca-system-proxy
Open

Enable JVM proxy system properties in Key Vault JCA HTTP client#49316
waiet wants to merge 3 commits into
Azure:mainfrom
waiet:codex/keyvault-jca-system-proxy

Conversation

@waiet
Copy link
Copy Markdown

@waiet waiet commented May 29, 2026

Problem

Fixes #28801.

The Key Vault JCA provider uses an internal Apache HttpClient in HttpUtil instead of the standard Azure SDK HTTP pipeline. As a result, standard JVM proxy properties such as https.proxyHost, https.proxyPort, http.proxyHost, http.proxyPort, and http.nonProxyHosts were not honored when the provider was used behind a corporate proxy.

Solution

Configure the internal Apache HttpClient builder with useSystemProperties() while preserving the existing SSL/truststore connection manager behavior.

This PR also adds unit-level proxy coverage and documents a jarsigner proxy example using standard JVM system properties.

Testing

Added a unit test that sets http.proxyHost and http.proxyPort, serves a local proxy response, and verifies HttpUtil.get routes through the proxy. The test locks JVM system properties while it runs to avoid interference with parallel JUnit execution.

Validated with module-level tests:
mvn -f sdk/keyvault/azure-security-keyvault-jca/pom.xml -DskipITs -Dgpg.skip -Dspotbugs.skip -Drevapi.skip -Dspotless.skip=true -Dcodesnippet.skip=true -Djacoco.skip=true -DheapDumpOnOom= test

Result: 80 tests, 0 failures, 0 errors, 29 skipped.

The root mvn -pl sdk/keyvault/azure-security-keyvault-jca -DskipITs -Dgpg.skip -Dspotbugs.skip -Drevapi.skip test command could not run in this sparse checkout because the root POM references modules not present locally.

@github-actions github-actions Bot added Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization. KeyVault labels May 29, 2026
@github-actions
Copy link
Copy Markdown
Contributor

Thank you for your contribution @waiet! We will review the pull request and get back to you soon.

@waiet
Copy link
Copy Markdown
Author

waiet commented May 29, 2026

@microsoft-github-policy-service agree company="IThink s. r. o."

@waiet waiet marked this pull request as ready for review May 29, 2026 21:38
@waiet waiet requested review from a team as code owners May 29, 2026 21:38
Copilot AI review requested due to automatic review settings May 29, 2026 21:38
@waiet waiet force-pushed the codex/keyvault-jca-system-proxy branch 4 times, most recently from ea872c2 to fda1379 Compare June 1, 2026 12:28
@waiet waiet marked this pull request as draft June 1, 2026 14:27
@waiet waiet marked this pull request as ready for review June 1, 2026 14:27
@waiet waiet force-pushed the codex/keyvault-jca-system-proxy branch 2 times, most recently from 670a55e to 310200d Compare June 1, 2026 21:05
@waiet
Copy link
Copy Markdown
Author

waiet commented Jun 1, 2026

Hi @moarychan , this PR adds support for standard JVM proxy system properties in the azure-security-keyvault-jca internal Apache HttpClient, The PR is ready for review when you have a chance. Thank you!

@waiet waiet force-pushed the codex/keyvault-jca-system-proxy branch 2 times, most recently from a0a51f5 to 6d0040f Compare June 2, 2026 10:10
@waiet waiet force-pushed the codex/keyvault-jca-system-proxy branch from 6d0040f to dfdc8f1 Compare June 2, 2026 21:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization. KeyVault

Projects

Status: Untriaged

Development

Successfully merging this pull request may close these issues.

[BUG] KeyVaultKeyStore fails to authenticate behind proxy

1 participant