<p>There is a fairly sizable <a href="https://docs.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/authentication-guidance?view=azure-devops" rel="nofollow noreferrer">range of authentication options</a>, based upon what you have said you are looking for a non-interactive login which rules out some options, and leaves the following:</p>

<ul>
<li><a href="https://github.com/microsoft/azure-devops-auth-samples/tree/master/DeviceProfileSample" rel="nofollow noreferrer">Device Profile</a> - probably not ideal for you given you would need to find a way to this in Java as the examples are few and far between and mostly written in C#.</li>
<li><a href="https://github.com/microsoft/azure-devops-auth-samples/tree/master/ClientLibraryConsoleAppSample" rel="nofollow noreferrer">TFS Application</a> - again not ideal given you would need to either find someone who has written a 3rd party client library for Java or write one yourself.</li>
<li>Azure DevOps Extension - while you could write an Azure DevOps extension, and use that to access Azure DevOps it's a lot of work and potentially would expose security issues.</li>
</ul>

<p>Given that we have probably ruled out non-interactive login to Azure DevOps you could also explore one of the two following options:</p>

<ul>
<li><strong>Interactive Logins</strong> - is there an option in your environment from forcing the user to authenticate with Azure DevOps using <a href="https://docs.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops" rel="nofollow noreferrer">OAuth</a> then capture the token for non-interactive use?  This is quite a common pattern with GitHub, GitLab and Bitbucket.</li>
<li><strong><a href="https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&amp;tabs=preview-page" rel="nofollow noreferrer">Personal Access Tokens</a></strong> - mostly this would be abusing a feature of Azure DevOps as these are designed for users not applications, although it could work in your constrained environment.</li>
<li><strong>Non-interactive Login using your Identity Provider</strong> - you haven't detailed who your Identity Provider is, but it is possible it supports authentication using Client Certificates, Shared Secrets, etc. which would give you a SAML token which could be exchanged for an Azure DevOps Access token.</li>
</ul>

<p>Hope those help.  </p>

CC BY-SA 4.0
2019-11-12T10:23:16.713Z
2019-11-12T10:23:16.713Z
Richard Slater
<p>We have a network where azure DevOps services can be used by logging in via SAML. There is an independent java application in that same network. </p>

<p>Can anyone please point out a way that this java application can get authenticated to Azure DevOps services via SAML, without any manual intervention? </p>

<p>PS: I've explored a lot of blogs but I couldn't find what I need specifically. Closest I got, was to register my java application as a AD tenant, but in our use case this can't be done. </p>

<p>Is there any other alternative? Please suggest.</p>

<azure-devops><azure><tfs>
How to authenticate, with azure devops services, using SAML via on premise standalone java application?
Kuldeep Singh
# How to authenticate, with azure devops services, using SAML via on premise standalone java application?

(Asked by: username_0 on 2019-11-12)

We have a network where azure DevOps services can be used by logging in via SAML. There is an independent java application in that same network.

Can anyone please point out a way that this java application can get authenticated to Azure DevOps services via SAML, without any manual intervention?

PS: I've explored a lot of blogs but I couldn't find what I need specifically. Closest I got, was to register my java application as a AD tenant, but in our use case this can't be done.

Is there any other alternative? Please suggest.

**Tags:** azure-devops, azure, tfs


---

## 1 answers

### Answer by username_1 on 2019-11-12. Score: 0

There is a fairly sizable [range of authentication options](https://docs.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/authentication-guidance?view=azure-devops), based upon what you have said you are looking for a non-interactive login which rules out some options, and leaves the following:

* [Device Profile](https://github.com/microsoft/azure-devops-auth-samples/tree/master/DeviceProfileSample) - probably not ideal for you given you would need to find a way to this in Java as the examples are few and far between and mostly written in C#.
* [TFS Application](https://github.com/microsoft/azure-devops-auth-samples/tree/master/ClientLibraryConsoleAppSample) - again not ideal given you would need to either find someone who has written a 3rd party client library for Java or write one yourself.
* Azure DevOps Extension - while you could write an Azure DevOps extension, and use that to access Azure DevOps it's a lot of work and potentially would expose security issues.

Given that we have probably ruled out non-interactive login to Azure DevOps you could also explore one of the two following options:

* **Interactive Logins** - is there an option in your environment from forcing the user to authenticate with Azure DevOps using [OAuth](https://docs.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops) then capture the token for non-interactive use? This is quite a common pattern with GitHub, GitLab and Bitbucket.
* **[Personal Access Tokens](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=preview-page)** - mostly this would be abusing a feature of Azure DevOps as these are designed for users not applications, although it could work in your constrained environment.
* **Non-interactive Login using your Identity Provider** - you haven't detailed who your Identity Provider is, but it is possible it supports authentication using Client Certificates, Shared Secrets, etc. which would give you a SAML token which could be exchanged for an Azure DevOps Access token.

Hope those help.


---

