Skip to content

Enable JVM proxy system properties in Key Vault JCA HTTP client#49316

Open
waiet wants to merge 3 commits into
Azure:mainfrom
waiet:codex/keyvault-jca-system-proxy
Open

Enable JVM proxy system properties in Key Vault JCA HTTP client#49316
waiet wants to merge 3 commits into
Azure:mainfrom
waiet:codex/keyvault-jca-system-proxy

Conversation

@waiet
Copy link
Copy Markdown

@waiet waiet commented May 29, 2026

Problem

Fixes #28801.

The Key Vault JCA provider uses an internal Apache HttpClient in HttpUtil instead of the standard Azure SDK HTTP pipeline. As a result, standard JVM proxy properties such as https.proxyHost, https.proxyPort, http.proxyHost, http.proxyPort, and http.nonProxyHosts were not honored when the provider was used behind a corporate proxy.

Solution

Configure the internal Apache HttpClient builder with useSystemProperties() while preserving the existing SSL/truststore connection manager behavior.

This PR also adds unit-level proxy coverage and documents a jarsigner proxy example using standard JVM system properties.

Testing

Added a unit test that sets http.proxyHost and http.proxyPort, serves a local proxy response, and verifies HttpUtil.get routes through the proxy. The test locks JVM system properties while it runs to avoid interference with parallel JUnit execution.

Validated with module-level tests:
mvn -f sdk/keyvault/azure-security-keyvault-jca/pom.xml -DskipITs -Dgpg.skip -Dspotbugs.skip -Drevapi.skip -Dspotless.skip=true -Dcodesnippet.skip=true -Djacoco.skip=true -DheapDumpOnOom= test

Result: 80 tests, 0 failures, 0 errors, 29 skipped.

The root mvn -pl sdk/keyvault/azure-security-keyvault-jca -DskipITs -Dgpg.skip -Dspotbugs.skip -Drevapi.skip test command could not run in this sparse checkout because the root POM references modules not present locally.

@github-actions github-actions Bot added Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization. KeyVault labels May 29, 2026
@github-actions
Copy link
Copy Markdown
Contributor

Thank you for your contribution @waiet! We will review the pull request and get back to you soon.

@waiet
Copy link
Copy Markdown
Author

waiet commented May 29, 2026

@microsoft-github-policy-service agree company="IThink s. r. o."

@waiet waiet marked this pull request as ready for review May 29, 2026 21:38
@waiet waiet requested review from a team as code owners May 29, 2026 21:38
Copilot AI review requested due to automatic review settings May 29, 2026 21:38
@waiet waiet force-pushed the codex/keyvault-jca-system-proxy branch from 84858e1 to 67f983b Compare May 30, 2026 19:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization. KeyVault

Projects

Status: Untriaged

Development

Successfully merging this pull request may close these issues.

[BUG] KeyVaultKeyStore fails to authenticate behind proxy

1 participant