How to fix SSL Exception Issue while embedding power bi contents in a react and java spring applicat

[INC_Saurabh]

We have Embedded Power bi Report inside a React & Java Spring boot based application using App Owns Data via Service Principal method. The application is hosted in Azure Kubernetes Service with a mapped subdomain cherrywork.com.

We can access the application using this URL, but the power bi contents embedded within this application is not visible. 

While looking at the issue, we got this error message : message:

"com.microsoft.aad.msal4j.MsalClientException: javax.net.ssl.SSLException: Connection reset"

There is no firewall restriction from my organization.

Using the Azure library in Java to try to obtain an access token with the following code:

ConfidentialClientApplication app = ConfidentialClientApplication.builder(             Constants.clientId,             ClientCredentialFactory.createFromSecret(Constants.appSecret))       .authority(Constants.authorityUrl + Constants.tenantId)       .build();
 
ClientCredentialParameters clientCreds = ClientCredentialParameters.builder(             Collections.singleton(Constants.scopeBase))       .build();
 
// Acquire new AAD token IAuthenticationResult result = app.acquireToken(clientCreds).get(); 

When I run the application on my local machine, it works fine. But once my organization deploys it to Azure Kubernetes Service, we get the following error :

2024-03-27 05:05:46.130 ERROR 1 --- [       Thread-2] c.m.a.m.ConfidentialClientApplication    : [Correlation ID: 26588393-a78f-4fe8-b8a3-b3350bead014] Execution of class com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier failed.
com.microsoft.aad.msal4j.MsalClientException: javax.net.ssl.SSLException: Connection reset
    at com.microsoft.aad.msal4j.HttpHelper.executeHttpRequest(HttpHelper.java:68) ~[msal4j-1.7.1.jar!/:1.7.1]
    at com.microsoft.aad.msal4j.AadInstanceDiscoveryProvider.sendInstanceDiscoveryRequest(AadInstanceDiscoveryProvider.java:119) ~[msal4j-1.7.1.jar!/:1.7.1]
    at com.microsoft.aad.msal4j.AadInstanceDiscoveryProvider.doInstanceDiscoveryAndCache(AadInstanceDiscoveryProvider.java:135) ~[msal4j-1.7.1.jar!/:1.7.1]
    at com.microsoft.aad.msal4j.AadInstanceDiscoveryProvider.getMetadataEntry(AadInstanceDiscoveryProvider.java:42) ~[msal4j-1.7.1.jar!/:1.7.1]
    at com.microsoft.aad.msal4j.AuthenticationResultSupplier.getAuthorityWithPrefNetworkHost(AuthenticationResultSupplier.java:32) [msal4j-1.7.1.jar!/:1.7.1]
    at com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier.execute(AcquireTokenByAuthorizationGrantSupplier.java:59) ~[msal4j-1.7.1.jar!/:1.7.1]
    at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:59) [msal4j-1.7.1.jar!/:1.7.1]
    at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:17) [msal4j-1.7.1.jar!/:1.7.1]
    at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1604) [na:1.8.0_382]
    at java.lang.Thread.run(Thread.java:750) [na:1.8.0_382]
Caused by: javax.net.ssl.SSLException: Connection reset
    at sun.security.ssl.Alert.createSSLException(Alert.java:127) ~[na:1.8.0_382]
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:331) ~[na:1.8.0_382]
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:274) ~[na:1.8.0_382]
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:269) ~[na:1.8.0_382]
    at sun.security.ssl.SSLTransport.decode(SSLTransport.java:138) ~[na:1.8.0_382]
    at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1401) ~[na:1.8.0_382]
    at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1309) ~[na:1.8.0_382]
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:440) ~[na:1.8.0_382]
    at sun.net.
www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
~[na:1.8.0_382]
    at sun.net.
www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:197)
~[na:1.8.0_382]
    at sun.net.
www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1572)
~[na:1.8.0_382]
    at sun.net.
www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1500)
~[na:1.8.0_382]
    at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480) ~[na:1.8.0_382]
    at sun.net.
www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:352)
~[na:1.8.0_382]
    at com.microsoft.aad.msal4j.DefaultHttpClient.readResponseFromConnection(DefaultHttpClient.java:107) ~[msal4j-1.7.1.jar!/:1.7.1]
    at com.microsoft.aad.msal4j.DefaultHttpClient.executeHttpGet(DefaultHttpClient.java:47) ~[msal4j-1.7.1.jar!/:1.7.1]
    at com.microsoft.aad.msal4j.DefaultHttpClient.send(DefaultHttpClient.java:35) ~[msal4j-1.7.1.jar!/:1.7.1]
    at com.microsoft.aad.msal4j.HttpHelper.executeHttpRequestWithRetries(HttpHelper.java:86) ~[msal4j-1.7.1.jar!/:1.7.1]
    at com.microsoft.aad.msal4j.HttpHelper.executeHttpRequest(HttpHelper.java:64) ~[msal4j-1.7.1.jar!/:1.7.1]
    ... 9 common frames omitted
    Suppressed: java.net.SocketException: Broken pipe (Write failed)
        at java.net.SocketOutputStream.socketWrite0(Native Method) ~[na:1.8.0_382]
        at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:111) ~[na:1.8.0_382]
        at java.net.SocketOutputStream.write(SocketOutputStream.java:155) ~[na:1.8.0_382]
        at sun.security.ssl.SSLSocketOutputRecord.encodeAlert(SSLSocketOutputRecord.java:81) ~[na:1.8.0_382]
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:362) ~[na:1.8.0_382]
        ... 26 common frames omitted
Caused by: java.net.SocketException: Connection reset
    at java.net.SocketInputStream.read(SocketInputStream.java:210) ~[na:1.8.0_382]
    at java.net.SocketInputStream.read(SocketInputStream.java:141) ~[na:1.8.0_382]
    at sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:464) ~[na:1.8.0_382]
    at sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:165) ~[na:1.8.0_382]
    at sun.security.ssl.SSLTransport.decode(SSLTransport.java:109) ~[na:1.8.0_382]
    ... 23 common frames omitted

Need help to resolve this issue asap. Please mention the steps that we should follow to resolve this issue.

We checked all the permissions:

1. app registration in Azure AD
2. Api permission for the App to Power BI Service
3. Client Secret
4. security group
5. Power BI Admin Portal -> Allowed to embed content in app & Service Principal to use Power BI Apis ( added security group)
6. power bi workspace access to Registered Application
7. Used Embedded URL, Embedded Token, Report ID to fetch the report

[INC_Saurabh]

After several possible analysis, we found that the issue was from the Application Deployment side. There was some issue in the Docker image creation process, which was restricting the power bi api that we have used to fetch the access token.

And how we arrived at this is when we copied the api code which fetches the access token to another application which is already deployed and running fine. By doing this experiment, we were able to fetch the access token without SSL Exception error. Once we got the access token we then fetched the Embed URL and passed it to frontend and it worked. We can now see the reports.
Redeployed the application and it's working fine now.

[v-yangliu-msft]

Hi  @INC_Saurabh ,

There may be differences in the trust store configuration.

You can check that the SSL certificates of the services with which your application communicates are correctly installed in the environment's trust store.

keytool (oracle.com)

This is the related document, you can view this content:

java - SSL Connection Reset - Stack Overflow

java - javax.net.ssl.SSLException: Connection reset on few request out of the total - Stack Overflow

java - SSL Exception: Connection reset - Stack Overflow

Best Regards,

Liu Yang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.