Class WorkloadIdentityCredential

java.lang.Object
com.azure.identity.WorkloadIdentityCredential
All Implemented Interfaces:
com.azure.core.credential.TokenCredential
public class WorkloadIdentityCredential extends Object implements com.azure.core.credential.TokenCredential

Authenticates workloads on Kubernetes by exchanging a projected service account token for a Microsoft Entra access token. The identity's federated identity credential defines which service account tokens are trusted, without requiring the application to manage a secret or certificate. Refer to Microsoft Entra Workload ID for more information.

Azure Kubernetes Service (AKS) identity bindings allow multiple clusters to share a user-assigned managed identity through a single AKS-managed federated identity credential. To route token exchanges through the AKS token proxy, call WorkloadIdentityCredentialBuilder.enableAzureProxy() when constructing this credential. Identity binding mode is disabled by default and is not supported by DefaultAzureCredential or ManagedIdentityCredential. The binding and Kubernetes permissions must be configured separately.

Sample: Construct WorkloadIdentityCredential

The following code sample demonstrates the creation of a WorkloadIdentityCredential, using the WorkloadIdentityCredentialBuilder to configure it. The clientId, is required to create WorkloadIdentityCredential. Once this credential is created, it may be passed into the builder of many of the Azure SDK for Java client builders as the 'credential' parameter.

TokenCredential workloadIdentityCredential = new WorkloadIdentityCredentialBuilder().clientId("<clientID>")
    .tenantId("<tenantID>")
    .tokenFilePath("<token-file-path>")
    .build();
See Also:

  • Method Details

    • getToken

      public Mono<com.azure.core.credential.AccessToken> getToken(com.azure.core.credential.TokenRequestContext request)
      Specified by:
      getToken in interface com.azure.core.credential.TokenCredential

    • getTokenSync

      public com.azure.core.credential.AccessToken getTokenSync(com.azure.core.credential.TokenRequestContext request)
      Specified by:
      getTokenSync in interface com.azure.core.credential.TokenCredential