Enum AzureCredentials 

pub enum AzureCredentials {
    ServicePrincipal {
        client_id: String,
        client_secret: String,
    },
    AccessToken {
        token: String,
    },
    ScopedAccessTokens {
        tokens: HashMap<String, String>,
    },
    VmManagedIdentity {
        client_id: String,
        identity_endpoint: Option<String>,
    },
    WorkloadIdentity {
        authority_host: String,
        client_id: String,
        federated_token_file: String,
        tenant_id: String,
    },
    ManagedIdentity {
        client_id: String,
        identity_endpoint: String,
        identity_header: String,
    },
}

Represents Azure authentication credentials

JSON schema

{
 "description": "Represents Azure authentication credentials",
 "oneOf": [
   {
     "description": "Service principal with client secret",
     "type": "object",
     "required": [
       "client_id",
       "client_secret",
       "type"
     ],
     "properties": {
       "client_id": {
         "description": "The client ID (application ID)",
         "type": "string"
       },
       "client_secret": {
         "description": "The client secret",
         "type": "string"
       },
       "type": {
         "type": "string",
         "enum": [
           "servicePrincipal"
         ]
       }
     }
   },
   {
     "description": "Direct access token",
     "type": "object",
     "required": [
       "token",
       "type"
     ],
     "properties": {
       "token": {
         "description": "The bearer token to use for authentication",
         "type": "string"
       },
       "type": {
         "type": "string",
         "enum": [
           "accessToken"
         ]
       }
     }
   },
   {
     "description": "Short-lived bearer tokens keyed by their exact Azure OAuth scope.\n\nThis is the only Azure credential form returned by the credential mint\nendpoint. It contains no refreshable source credential and must not be\nused for a scope that is absent from the map.",
     "type": "object",
     "required": [
       "tokens",
       "type"
     ],
     "properties": {
       "tokens": {
         "description": "Exact scope-to-token map. Minted configs include only the Azure\nmanagement, storage, Key Vault, and Service Bus scopes used by\nAlien bindings.",
         "type": "object",
         "additionalProperties": {
           "type": "string"
         }
       },
       "type": {
         "type": "string",
         "enum": [
           "scopedAccessTokens"
         ]
       }
     }
   },
   {
     "description": "Azure VM IMDS managed identity.",
     "type": "object",
     "required": [
       "client_id",
       "type"
     ],
     "properties": {
       "client_id": {
         "description": "The client ID of the user-assigned managed identity",
         "type": "string"
       },
       "identity_endpoint": {
         "description": "Optional IMDS endpoint override",
         "type": [
           "string",
           "null"
         ]
       },
       "type": {
         "type": "string",
         "enum": [
           "vmManagedIdentity"
         ]
       }
     }
   },
   {
     "description": "Azure AD Workload Identity (federated identity)",
     "type": "object",
     "required": [
       "authority_host",
       "client_id",
       "federated_token_file",
       "tenant_id",
       "type"
     ],
     "properties": {
       "authority_host": {
         "description": "The authority host URL",
         "type": "string"
       },
       "client_id": {
         "description": "The client ID of the managed identity or application",
         "type": "string"
       },
       "federated_token_file": {
         "description": "Path to the federated token file",
         "type": "string"
       },
       "tenant_id": {
         "description": "The tenant ID for authentication",
         "type": "string"
       },
       "type": {
         "type": "string",
         "enum": [
           "workloadIdentity"
         ]
       }
     }
   },
   {
     "description": "Azure Managed Identity (Container Apps / App Service)\nUses IDENTITY_ENDPOINT + IDENTITY_HEADER injected by the platform",
     "type": "object",
     "required": [
       "client_id",
       "identity_endpoint",
       "identity_header",
       "type"
     ],
     "properties": {
       "client_id": {
         "description": "The client ID of the user-assigned managed identity",
         "type": "string"
       },
       "identity_endpoint": {
         "description": "The identity endpoint URL (from IDENTITY_ENDPOINT env var)",
         "type": "string"
       },
       "identity_header": {
         "description": "The identity header secret (from IDENTITY_HEADER env var)",
         "type": "string"
       },
       "type": {
         "type": "string",
         "enum": [
           "managedIdentity"
         ]
       }
     }
   }
 ]
}

Variants

ServicePrincipal

Service principal with client secret

Fields

client_id: String

The client ID (application ID)

client_secret: String

The client secret

AccessToken

Direct access token

Fields

token: String

The bearer token to use for authentication

ScopedAccessTokens

Short-lived bearer tokens keyed by their exact Azure OAuth scope.

This is the only Azure credential form returned by the credential mint endpoint. It contains no refreshable source credential and must not be used for a scope that is absent from the map.

Fields

tokens: HashMap<String, String>

Exact scope-to-token map. Minted configs include only the Azure management, storage, Key Vault, and Service Bus scopes used by Alien bindings.

VmManagedIdentity

Azure VM IMDS managed identity.

Fields

client_id: String

The client ID of the user-assigned managed identity

identity_endpoint: Option<String>

Optional IMDS endpoint override

WorkloadIdentity

Azure AD Workload Identity (federated identity)

Fields

authority_host: String

The authority host URL

client_id: String

The client ID of the managed identity or application

federated_token_file: String

Path to the federated token file

tenant_id: String

The tenant ID for authentication

ManagedIdentity

Azure Managed Identity (Container Apps / App Service) Uses IDENTITY_ENDPOINT + IDENTITY_HEADER injected by the platform

Fields

client_id: String

The client ID of the user-assigned managed identity

identity_endpoint: String

The identity endpoint URL (from IDENTITY_ENDPOINT env var)

identity_header: String

The identity header secret (from IDENTITY_HEADER env var)

Trait Implementations

impl Clone for AzureCredentials

fn clone(&self) -> AzureCredentials

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AzureCredentials

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AzureCredentials

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl From<&AzureCredentials> for AzureCredentials

fn from(value: &AzureCredentials) -> Self

Converts to this type from the input type.

impl Serialize for AzureCredentials

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.