Class WorkloadIdentityCredentialBuilder

java.lang.Object
com.azure.identity.CredentialBuilderBase<WorkloadIdentityCredentialBuilder>
com.azure.identity.AadCredentialBuilderBase<WorkloadIdentityCredentialBuilder>
com.azure.identity.WorkloadIdentityCredentialBuilder
All Implemented Interfaces:
com.azure.core.client.traits.HttpTrait<WorkloadIdentityCredentialBuilder>
public class WorkloadIdentityCredentialBuilder extends AadCredentialBuilderBase<WorkloadIdentityCredentialBuilder>
Fluent credential builder for instantiating a WorkloadIdentityCredential.

Workload identity authentication exchanges a projected Kubernetes service account token for a Microsoft Entra access token, without requiring an application secret or certificate. The credential reads its tenant ID, client ID, and token file path from the workload identity environment variables unless they are configured on this builder. Refer to Microsoft Entra Workload ID for more information. To use Azure Kubernetes Service identity bindings, opt in with enableAzureProxy().

Sample: Construct WorkloadIdentityCredential

The following code sample demonstrates the creation of a WorkloadIdentityCredential, using the WorkloadIdentityCredentialBuilder to configure it. The clientId, is required to create WorkloadIdentityCredential. Once this credential is created, it may be passed into the builder of many of the Azure SDK for Java client builders as the 'credential' parameter.

TokenCredential workloadIdentityCredential = new WorkloadIdentityCredentialBuilder().clientId("<clientID>")
    .tenantId("<tenantID>")
    .tokenFilePath("<token-file-path>")
    .build();
See Also:

  • Constructor Details

    • WorkloadIdentityCredentialBuilder

      public WorkloadIdentityCredentialBuilder()
      Creates an instance of a WorkloadIdentityCredentialBuilder.

  • Method Details

    • tokenFilePath

      public WorkloadIdentityCredentialBuilder tokenFilePath(String tokenFilePath)
      Configure the path to a file containing a Kubernetes service account token that authenticates the identity. The file path is required to authenticate.
      Parameters:
      tokenFilePath - the path to the file containing the token to use for authentication.
      Returns:
      An updated instance of this builder with the tenant id set as specified.

    • enableAzureProxy

      public WorkloadIdentityCredentialBuilder enableAzureProxy()
      Enables Azure Kubernetes Service (AKS) identity bindings. When proxy configuration is present, authentication requests are sent through the AKS token proxy instead of directly to Microsoft Entra ID.

      This feature is disabled by default and requires using WorkloadIdentityCredential directly. It is not supported by DefaultAzureCredential or ManagedIdentityCredential. The AKS identity binding and Kubernetes permissions must be configured separately. See AKS identity bindings.

      The AKS webhook supplies AZURE_KUBERNETES_TOKEN_PROXY, AZURE_KUBERNETES_SNI_NAME, and either AZURE_KUBERNETES_CA_FILE or AZURE_KUBERNETES_CA_DATA. Inline CA data must be PEM encoded, not Base64 encoded. If neither CA setting is provided, the platform trust store is used. Changes to a CA file are reloaded on subsequent network requests. Missing or empty files during rotation retain the previously loaded CA; invalid nonempty certificate bundles fail authentication.

      If no proxy settings are present, the credential uses direct authentication. Incomplete or invalid proxy configuration fails rather than falling back to direct authentication. When a proxy is configured, its dedicated transport is set on a copy of the credential options, replacing any client set with CredentialBuilderBase.httpClient(com.azure.core.http.HttpClient). A custom HTTP pipeline retains its usual precedence over HTTP client settings. Keep the authority host set to the Microsoft Entra authority, not the proxy URL.

      Sample: Enable AKS identity bindings

      WorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder()
    .enableAzureProxy()
    .build();
      Returns:
      An updated instance of this builder with Azure proxy enabled.

    • build

      public WorkloadIdentityCredential build()
      Creates new WorkloadIdentityCredential with the configured options set.
      Returns:
      a WorkloadIdentityCredential with the current configurations.
      Throws:
      IllegalArgumentException - if required workload identity settings are missing or proxy configuration is invalid.