Answers: <p>There is a fairly sizable <a href="https://docs.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/authentication-guidance?view=azure-devops" rel="nofollow noreferrer">range of authentication options</a>, based upon what you have said you are looking for a non-interactive login which rules out some options, and leaves the following:</p>
  
  <ul>
  <li><a href="https://github.com/microsoft/azure-devops-auth-samples/tree/master/DeviceProfileSample" rel="nofollow noreferrer">Device Profile</a> - probably not ideal for you given you would need to find a way to this in Java as the examples are few and far between and mostly written in C#.</li>
  <li><a href="https://github.com/microsoft/azure-devops-auth-samples/tree/master/ClientLibraryConsoleAppSample" rel="nofollow noreferrer">TFS Application</a> - again not ideal given you would need to either find someone who has written a 3rd party client library for Java or write one yourself.</li>
  <li>Azure DevOps Extension - while you could write an Azure DevOps extension, and use that to access Azure DevOps it's a lot of work and potentially would expose security issues.</li>
  </ul>
  
  <p>Given that we have probably ruled out non-interactive login to Azure DevOps you could also explore one of the two following options:</p>
  
  <ul>
  <li><strong>Interactive Logins</strong> - is there an option in your environment from forcing the user to authenticate with Azure DevOps using <a href="https://docs.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops" rel="nofollow noreferrer">OAuth</a> then capture the token for non-interactive use?  This is quite a common pattern with GitHub, GitLab and Bitbucket.</li>
  <li><strong><a href="https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&amp;tabs=preview-page" rel="nofollow noreferrer">Personal Access Tokens</a></strong> - mostly this would be abusing a feature of Azure DevOps as these are designed for users not applications, although it could work in your constrained environment.</li>
  <li><strong>Non-interactive Login using your Identity Provider</strong> - you haven't detailed who your Identity Provider is, but it is possible it supports authentication using Client Certificates, Shared Secrets, etc. which would give you a SAML token which could be exchanged for an Azure DevOps Access token.</li>
  </ul>
  
  <p>Hope those help.  </p>
  
Answers: CC BY-SA 4.0
Answers: 2019-11-12T10:23:16.713Z
Answers: 2019-11-12T10:23:16.713Z
Answers: Richard Slater
Body: <p>We have a network where azure DevOps services can be used by logging in via SAML. There is an independent java application in that same network. </p>
  
  <p>Can anyone please point out a way that this java application can get authenticated to Azure DevOps services via SAML, without any manual intervention? </p>
  
  <p>PS: I've explored a lot of blogs but I couldn't find what I need specifically. Closest I got, was to register my java application as a AD tenant, but in our use case this can't be done. </p>
  
  <p>Is there any other alternative? Please suggest.</p>
  
Tags: <azure-devops><azure><tfs>
Title: How to authenticate, with azure devops services, using SAML via on premise standalone java application?
UserDisplayName: Kuldeep Singh
ThreadText: # How to authenticate, with azure devops services, using SAML via on premise standalone java application?
  
  (Asked by: username_0 on 2019-11-12)
  
  We have a network where azure DevOps services can be used by logging in via SAML. There is an independent java application in that same network.
  
  Can anyone please point out a way that this java application can get authenticated to Azure DevOps services via SAML, without any manual intervention?
  
  PS: I've explored a lot of blogs but I couldn't find what I need specifically. Closest I got, was to register my java application as a AD tenant, but in our use case this can't be done.
  
  Is there any other alternative? Please suggest.
  
  **Tags:** azure-devops, azure, tfs
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-11-12. Score: 0
  
  There is a fairly sizable [range of authentication options](https://docs.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/authentication-guidance?view=azure-devops), based upon what you have said you are looking for a non-interactive login which rules out some options, and leaves the following:
  
  * [Device Profile](https://github.com/microsoft/azure-devops-auth-samples/tree/master/DeviceProfileSample) - probably not ideal for you given you would need to find a way to this in Java as the examples are few and far between and mostly written in C#.
  * [TFS Application](https://github.com/microsoft/azure-devops-auth-samples/tree/master/ClientLibraryConsoleAppSample) - again not ideal given you would need to either find someone who has written a 3rd party client library for Java or write one yourself.
  * Azure DevOps Extension - while you could write an Azure DevOps extension, and use that to access Azure DevOps it's a lot of work and potentially would expose security issues.
  
  Given that we have probably ruled out non-interactive login to Azure DevOps you could also explore one of the two following options:
  
  * **Interactive Logins** - is there an option in your environment from forcing the user to authenticate with Azure DevOps using [OAuth](https://docs.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops) then capture the token for non-interactive use? This is quite a common pattern with GitHub, GitLab and Bitbucket.
  * **[Personal Access Tokens](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=preview-page)** - mostly this would be abusing a feature of Azure DevOps as these are designed for users not applications, although it could work in your constrained environment.
  * **Non-interactive Login using your Identity Provider** - you haven't detailed who your Identity Provider is, but it is possible it supports authentication using Client Certificates, Shared Secrets, etc. which would give you a SAML token which could be exchanged for an Azure DevOps Access token.
  
  Hope those help.
  
  
  ---
  
  