Keyvault JCA's AccessTokenUtil does not urlencode its parameters when getting an access token

[guillaumepichenot]

Describe the bug
In our app, we get NullPointerException when first accessing a key through a com.azure.security.keyvault.jca.implementation.KeyVaultClient method.

We have all the reasons to believe our configuration is OK, as multiple other KeyVault-based elements in the stack work OK (e.g. KeyVault as property source, SecretClient instances...). The configuration / interaction mode with keyvault is client_id / client_secret based.

On top of it, the same code works on many environments (preproduction...) but the NPE occurs only in production, with the seemingly only relevant difference being the actual values client_id / client_secert.

Finally, it's pretty clear to me, having looked at it for a few hours that the issue is :
a) hidden by the fact that the HTTP interactions made by the library output nothing / no log / error when HTTP error occurs (40x, 50x, ...)
b) triggered while accessing the accessToken by tenant id / client id / client secret.
c) more excplicetly, because the client_secret is not URL-encoded, which triggers a (rightfull) signin failed error on https://login.microsoftonline.com's side : the secret is "wrong"

Exception or Stack Trace

Factory method 'myBeanMethod' 
  threw exception; nested exception is java.lang.NullPointerException: 
  Cannot invoke "com.azure.security.keyvault.jca.implementation.model.AccessToken.getAccessToken()" 
    because "this.accessToken" is null

Note : there is no stack trace for the HTTP-call that tries to retrieve the token but Azure Portal (Enterprise application sign-in logs) show a failed login attempt, in our case, with an Invalid client secret failure reason.

To Reproduce

• Create an azure entreprise application with a client secret that requires escaping to conform to x-www-form-urlencoding (eg @ or [] come to mind
• Instantiate a com.azure.security.keyvault.jca.implementation.KeyVaultClient using the valid clientid / secret / tenant ID / keyvault URL
• Perform an operation (getKey, getCertificate)
• NPE is thrown

Code Snippet

	private void azureJcaKeyVaultClient(AzureKeyVaultSecretProperties kvProperties) {
		String clientId = kvProperties.getCredential().getClientId();
		String clientSecret = kvProperties.getCredential().getClientSecret();
		String tenantId = kvProperties.getProfile().getTenantId();
		String endpoint = kvProperties.getEndpoint();

		var c = new KeyVaultClient(endpoint, tenantId, clientId, clientSecret);
                c.getKey("someKey");
	}

Expected behavior
Have a successfull login when the client secret (or any other authentication variable) require encoding to conform to the HTTP status

Screenshots
N/A

Setup (please complete the following information):

• OS: Linux, MacOS
• IDE: IntelliJ, deployed on Azure Linux ASP
• Library/Libraries: com.azure:azure-security-keyvault-jca:2.8.1
• Java version: 11, 17, 21
• App Server/Environment: SpringBoot / Tomcat

Additional context
The bug is pretty clear when looking at current implementation :

azure-sdk-for-java/sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java

Lines 93 to 111 in dcbfa34

	AccessToken result = null;
	StringBuilder oauth2Url = new StringBuilder();
	oauth2Url.append(aadAuthenticationUrl == null ? OAUTH2_TOKEN_BASE_URL : aadAuthenticationUrl)
	.append(tenantId)
	.append(OAUTH2_TOKEN_POSTFIX);
	StringBuilder requestBody = new StringBuilder();
	requestBody.append(GRANT_TYPE_FRAGMENT)
	.append(CLIENT_ID_FRAGMENT).append(clientId)
	.append(CLIENT_SECRET_FRAGMENT).append(clientSecret)
	.append(RESOURCE_FRAGMENT).append(resource);
	String body = HttpUtil
	.post(oauth2Url.toString(), requestBody.toString(), "application/x-www-form-urlencoded");
	if (body != null) {
	result = (AccessToken) JsonConverterUtil.fromJson(body, AccessToken.class);
	}
	LOGGER.log(FINER, "Access token: {0}", result);

Raw string concatenation may or may not work considering the request's content type.

Information Checklist
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

• Bug Description Added
• Repro Steps Added
• Setup information Added

[github-actions]

@moarychan @Netyyyy @rujche @saragluna

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.