Tutorial: Connect to a PostgreSQL Database from Java Tomcat App Service without secrets using a managed identity

Azure App Service provides a highly scalable, self-patching web hosting service in Azure. It also provides a managed identity for your app, which is a turn-key solution for securing access to Azure Database for PostgreSQL and other Azure services. Managed identities in App Service make your app more secure by eliminating secrets from your app, such as credentials in the environment variables. In this tutorial, you will learn how to:

If you don't have an Azure subscription, create a trial account before you begin.

• Git
• Java JDK
• Maven
• Azure CLI version 2.41.0 or higher.

Run the following commands in your terminal to clone the sample repo and set up the sample app environment.

git clone https://github.com/Azure-Samples/Passwordless-Connections-for-Java-Apps
cd Passwordless-Connections-for-Java-Apps/Tomcat/

Follow these steps to create an Azure Database for Postgres in your subscription. The Spring Boot app will connect to this database and store its data when running, persisting the application state no matter where you run the application.

1. Sign into the Azure CLI, and optionally set your subscription if you have more than one connected to your login credentials.

   az login
   az account set --subscription <subscription-ID>
   

2. Create an Azure Resource Group, noting the resource group name.

   RESOURCE_GROUP=<resource-group-name>
   LOCATION=chinaeast2
   
   az group create --name $RESOURCE_GROUP --location $LOCATION
   

3. Create an Azure Database for PostgreSQL server. The server is created with an administrator account, but it won't be used because we'll use the Azure Active Directory (Azure AD) admin account to perform administrative tasks.

   • Flexible Server
   • Single Server

   POSTGRESQL_ADMIN_USER=azureuser
   # PostgreSQL admin access rights won't be used because Azure AD authentication is leveraged to administer the database.
   POSTGRESQL_ADMIN_PASSWORD=<admin-password>
   POSTGRESQL_HOST=<postgresql-host-name>
   
   # Create a PostgreSQL server.
   az postgres flexible-server create \
       --resource-group $RESOURCE_GROUP \
       --name $POSTGRESQL_HOST \
       --location $LOCATION \
       --admin-user $POSTGRESQL_ADMIN_USER \
       --admin-password $POSTGRESQL_ADMIN_PASSWORD \
       --public-network-access 0.0.0.0 \
       --sku-name Standard_D2s_v3 
   

4. Create a database for the application.

   • Flexible Server
   • Single Server

   DATABASE_NAME=checklist
   
   az postgres flexible-server db create \
       --resource-group $RESOURCE_GROUP \
       --server-name $POSTGRESQL_HOST \
       --database-name $DATABASE_NAME
   

Follow these steps to build a WAR file and deploy to Azure App Service on Tomcat using a WAR packaging.

1. The sample app contains a pom.xml file that can generate the WAR file. Run the following command to build the app.

   mvn clean package -f pom.xml
   

2. Create an Azure App Service resource on Linux using Tomcat 9.0.

   APPSERVICE_PLAN=<app-service-plan>
   APPSERVICE_NAME=<app-service-name>
   # Create an App Service plan
   az appservice plan create \
       --resource-group $RESOURCE_GROUP \
       --name $APPSERVICE_PLAN \
       --location $LOCATION \
       --sku B1 \
       --is-linux
   
   # Create an App Service resource.
   az webapp create \
       --resource-group $RESOURCE_GROUP \
       --name $APPSERVICE_NAME \
       --plan $APPSERVICE_PLAN \
       --runtime "TOMCAT:9.0-jre8" 
   

3. Deploy the WAR package to App Service.

   az webapp deploy \
       --resource-group $RESOURCE_GROUP \
       --name $APPSERVICE_NAME \
       --src-path target/app.war \
       --type war
   

az webapp connection create postgres-flexible \
    --resource-group $RESOURCE_GROUP \
    --name $APPSERVICE_NAME \
    --target-resource-group $RESOURCE_GROUP \
    --server $POSTGRESQL_HOST \
    --database $DATABASE_NAME \
    --system-identity

az webapp connection create postgres \
    --resource-group $RESOURCE_GROUP \
    --name $APPSERVICE_NAME \
    --target-resource-group $RESOURCE_GROUP \
    --server $POSTGRESQL_HOST \
    --database $DATABASE_NAME \
    --system-identity

This command creates a connection between your web app and your PostgreSQL server, and manages authentication through a system-assigned managed identity.

Run the following command to open the deployed web app in your browser.

az webapp browse \
    --resource-group $RESOURCE_GROUP \
    --name MyWebapp \
    --name $APPSERVICE_NAME

In the preceding steps, you created Azure resources in a resource group. If you don't expect to need these resources in the future, delete the resource group by running the following command in the local Azure CLI:

az group delete --name myResourceGroup

This command may take a minute to run.

Learn more about running Java apps on App Service on Linux in the developer guide.

Learn how to secure your app with a custom domain and certificate.