Skip to content

Enable JVM proxy system properties in Key Vault JCA HTTP client#49316

Open
waiet wants to merge 3 commits into
Azure:mainfrom
waiet:codex/keyvault-jca-system-proxy
Open

Enable JVM proxy system properties in Key Vault JCA HTTP client#49316
waiet wants to merge 3 commits into
Azure:mainfrom
waiet:codex/keyvault-jca-system-proxy

Conversation

@waiet
Copy link
Copy Markdown

@waiet waiet commented May 29, 2026

Problem

Fixes #28801.

The Key Vault JCA provider uses an internal Apache HttpClient in HttpUtil instead of the standard Azure SDK HTTP pipeline. As a result, standard JVM proxy properties such as https.proxyHost, https.proxyPort, http.proxyHost, http.proxyPort, and http.nonProxyHosts were not honored when the provider was used behind a corporate proxy.

Solution

Configure the internal Apache HttpClient builder with useSystemProperties() while preserving the existing SSL/truststore connection manager behavior.

This PR also adds unit-level proxy coverage and documents a jarsigner proxy example using standard JVM system properties.

Testing

Added a unit test that sets http.proxyHost and http.proxyPort, serves a local proxy response, and verifies HttpUtil.get routes through the proxy. The test locks JVM system properties while it runs to avoid interference with parallel JUnit execution.

Validated with module-level tests:
mvn -f sdk/keyvault/azure-security-keyvault-jca/pom.xml -DskipITs -Dgpg.skip -Dspotbugs.skip -Drevapi.skip -Dspotless.skip=true -Dcodesnippet.skip=true -Djacoco.skip=true -DheapDumpOnOom= test

Result: 80 tests, 0 failures, 0 errors, 29 skipped.

The root mvn -pl sdk/keyvault/azure-security-keyvault-jca -DskipITs -Dgpg.skip -Dspotbugs.skip -Drevapi.skip test command could not run in this sparse checkout because the root POM references modules not present locally.

@github-actions github-actions Bot added Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization. KeyVault labels May 29, 2026
@github-actions
Copy link
Copy Markdown
Contributor

Thank you for your contribution @waiet! We will review the pull request and get back to you soon.

@waiet
Copy link
Copy Markdown
Author

waiet commented May 29, 2026

@microsoft-github-policy-service agree company="IThink s. r. o."

@waiet waiet marked this pull request as ready for review May 29, 2026 21:38
@waiet waiet requested review from a team as code owners May 29, 2026 21:38
Copilot AI review requested due to automatic review settings May 29, 2026 21:38
@waiet waiet force-pushed the codex/keyvault-jca-system-proxy branch 4 times, most recently from ea872c2 to fda1379 Compare June 1, 2026 12:28
@waiet waiet marked this pull request as draft June 1, 2026 14:27
@waiet waiet marked this pull request as ready for review June 1, 2026 14:27
@waiet waiet force-pushed the codex/keyvault-jca-system-proxy branch from fda1379 to f8b4219 Compare June 1, 2026 17:41
@waiet waiet force-pushed the codex/keyvault-jca-system-proxy branch from 670a55e to 310200d Compare June 1, 2026 21:05
@waiet
Copy link
Copy Markdown
Author

waiet commented Jun 1, 2026

Hi @moarychan , this PR adds support for standard JVM proxy system properties in the azure-security-keyvault-jca internal Apache HttpClient, The PR is ready for review when you have a chance. Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization. KeyVault

Projects

Status: Untriaged

Development

Successfully merging this pull request may close these issues.

[BUG] KeyVaultKeyStore fails to authenticate behind proxy

1 participant