WorkloadIdentityCredential Class

Package:

com.azure.identity

Maven Artifact:

com.azure:azure-identity:1.19.0

• java.lang.Object
• • com.azure.identity.WorkloadIdentityCredential

Implements

TokenCredential

public class WorkloadIdentityCredential
implements TokenCredential

Authenticates workloads on Kubernetes by exchanging a projected service account token for a Microsoft Entra access token. The identity's federated identity credential defines which service account tokens are trusted, without requiring the application to manage a secret or certificate. Refer to Microsoft Entra Workload ID for more information.

Azure Kubernetes Service (AKS) identity bindings allow multiple clusters to share a user-assigned managed identity through a single AKS-managed federated identity credential. To route token exchanges through the AKS token proxy, call enableAzureProxy() when constructing this credential. Identity binding mode is disabled by default and is not supported by DefaultAzureCredential or ManagedIdentityCredential. The binding and Kubernetes permissions must be configured separately.

Sample: Construct WorkloadIdentityCredential

The following code sample demonstrates the creation of a WorkloadIdentityCredential, using the WorkloadIdentityCredentialBuilder to configure it. The clientId, is required to create WorkloadIdentityCredential. Once this credential is created, it may be passed into the builder of many of the Azure SDK for Java client builders as the 'credential' parameter.

TokenCredential workloadIdentityCredential = new WorkloadIdentityCredentialBuilder().clientId("<clientID>")
     .tenantId("<tenantID>")
     .tokenFilePath("<token-file-path>")
     .build();

Method Summary

Modifier and Type	Method and Description
reactor.core.publisher.Mono<AccessToken>	getToken(TokenRequestContext request)
AccessToken	getTokenSync(TokenRequestContext request)

Methods inherited from java.lang.Object

clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Method Details

getToken

public Mono<AccessToken> getToken(TokenRequestContext request)

Parameters:

request

getTokenSync

public AccessToken getTokenSync(TokenRequestContext request)

Parameters:

request