> {
return next.handle(request).pipe(
catchError((error: HttpErrorResponse) => {
if (error.status === 401) {
// Handle token expiration
this.authService.login();
}
if (error.status === 403) {
// Handle unauthorized access
this.router.navigate(['/unauthorized']);
}
return throwError(() => error);
})
);
}
}
```
+ **Session timeout configuration.** Configure session timeout settings in both the AWS Blu Age Runtime and Microsoft Entra ID. For example, add the following code to your `application-main.yml` file:
```
server:
servlet:
session:
timeout: 3600 # 1 hour in seconds
```
+ **MsalGuard.** You must implement the MsalGuard feature for all protected routes to prevent unauthorized access. For example:
```
const routes: Routes = [
{ path: '', redirectTo: '/transaction-runner', pathMatch: 'full' },
{ path: 'transaction-runner', component: TransactionRunnerComponent, canActivate:guards },
{ path: 'user-info', component: UserInfoComponent, canActivate:guards },
{ path: 'term/:transid/:commarea', component: TermComponent, canActivate:guards },
{ path: 'code', component: TransactionRunnerComponent }
];
```
Routes that don’t have MsalGuard protection will be accessible without authentication, potentially exposing sensitive functionality. Make sure that all routes that require authentication include the guards in their configuration.
## Epics
### Set up a Microsoft Entra ID
| Task | Description | Skills required |
| --- | --- | --- |
| Set up a Microsoft Azure account to create an Entra ID. | For options and instructions, see the [Microsoft Azure website](https://azure.microsoft.com/en-us/free/). | App developer |
| Set up a Microsoft Entra ID in your application. | To learn how to add Microsoft Entra ID B2C (Azure AD B2C) authentication to your Angular SPA, see the [Microsoft documentation](https://learn.microsoft.com/en-us/azure/active-directory-b2c/enable-authentication-angular-spa-app#add-the-authentication-components). Specifically:[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/implement-entra-id-authentication-in-aws-blu-age-modernized-mainframe-application.html) | App developer |
### Clone the repository and deploy your AWS Blu Age code
| Task | Description | Skills required |
| --- | --- | --- |
| Clone the GitHub repository to get the Angular code required for authentication. | Run the following command to clone the [GitHub repository](https://github.com/aws-samples/sample-microsoft-entra-id-based-auth-in-aws-bluage-modernized-mainframe-app) that’s provided with this pattern into your local current working directory:git clone https://github.com/aws-samples/sample-microsoft-entra-id-based-auth-in-aws-bluage-modernized-mainframe-app.git
| App developer |
| Deploy the AWS Blu Age modernized code on a Tomcat server to implement authentication. | To set up the local environment that includes Tomcat and the Angular development server, follow the installation steps provided by the AWS Blu Age team as part of your customer engagement with AWS Professional Services. | App developer |
### Build the authentication solution
| Task | Description | Skills required |
| --- | --- | --- |
| Enable AWS Blu Age Runtime security to protect the AWS Blu Age REST API endpoints. | Configure the `application-main.yml` file that the AWS Blu Age Runtime uses as follows. For an example of this file, see the [Code repository](#implement-entra-id-authentication-in-aws-blu-age-modernized-mainframe-application-tools) section earlier in this pattern.[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/implement-entra-id-authentication-in-aws-blu-age-modernized-mainframe-application.html) | App developer |
| Incorporate the example code from your local environment into your Blu Age modernized Angular code base. | For information about how to incorporate the example into your AWS Blu Age modernized Angular code base, see the [Code repository](#implement-entra-id-authentication-in-aws-blu-age-modernized-mainframe-application-tools) section earlier in this pattern. | App developer |
| Place the `oauth2-ext` library in the shared directory. | Place the `oauth2-ext` library in the** **shared directory of the application server so that your** **AWS Blu Age modernized application can use it**. **Run the following commands:cd oauth2-ext/target
cp extension-oauth-filter-.jar /{app-server-home}/shared/
| App developer |
### Deploy the authentication solution
| Task | Description | Skills required |
| --- | --- | --- |
| Deploy the frontend application. | Run the following commands to start the frontend application locally:npm install
ng serve --ssl
npm start
Adding the `--ssl` flag to the `ng serve` command ensures that the development server uses HTTPS, which is more secure than other protocols and provides a better simulation of a production environment. | App developer |
| Start the backend application. | Start Tomcat server in Eclipse. | App developer |
### Test the application
| Task | Description | Skills required |
| --- | --- | --- |
| Test login functionality. | Access the locally deployed application at `http://localhost:4200` to verify that users are asked to confirm their identity.HTTP is used here for demonstration purposes. In a production or other publicly accessible environment, you must use HTTPS for security. Even for local development, we recommend that you set up HTTPS when possible.The Microsoft login prompt should appear, and users who are configured in Microsoft Entra ID should be allowed to access the application. | App developer |
| Test the authorization header in the request. | The following steps use the [CardDemo](https://github.com/aws-samples/aws-mainframe-modernization-carddemo) application as an example. Testing steps for other modern applications will vary.[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/implement-entra-id-authentication-in-aws-blu-age-modernized-mainframe-application.html) | App developer |
| Test the logout functionality. | Choose **Quit** to log out, and try to access the application again. It should present a new login prompt. | App developer |
## Troubleshooting
| Issue | Solution |
| --- | --- |
| The token issued by Microsoft Entra ID isn’t compatible with Spring Boot OAuth 2.0 security. | For a resolution to the issue, see [Microsoft Entra ID OAuth Flow](https://authguidance.com/azure-ad-troubleshooting/) on the OAuth blog. |
| General token-related questions. | To decode and view the contents of a JWT token, use the [https://jwt.io/](https://jwt.io/) website. |
## Related resources
+ For information about refactoring your application by using AWS Blu Age, see the [AWS Mainframe Modernization documentation](https://docs.aws.amazon.com/m2/latest/userguide/refactoring-m2.html).
+ To understand how OAuth 2.0 works, see the [OAuth 2.0 website](https://oauth.net/2/).
+ For an overview of the Microsoft Authentication Library (MSAL), see the [Microsoft Entra documentation](https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-overview).
+ For information about user profiles on an AS/400 system, see the [IBM i (AS400) tutorial](https://www.go4as400.com/subsystem-jobs-user-profile-in-as400/jobs.aspx?cid=14).
+ For the OAuth 2.0 and OpenID Connect (OIDC) authentication flow in the Microsoft identity platform, see the [Microsoft Entra documentation](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols).