Enum CredentialKind 

pub enum CredentialKind {
    Secret {
        client_secret: String,
    },
    Certificate {
        private_key_pem: String,
        x5t_s256: String,
    },
    Federated {
        token_file: String,
    },
}

How the server proves it is the app registration.

Federated is the one to reach for: the assertion is the workload’s own platform-issued identity token, so there is no durable secret to store, rotate or leak.

Variants

Secret

The ordinary confidential-client secret. Expires, and must be rotated by hand.

Fields

client_secret: String

Certificate

A certificate credential: we sign the assertion ourselves, so the key never crosses the wire. x5t_s256 is the certificate’s base64url SHA-256 thumbprint, which Entra uses to pick the registered public key.

Fields

private_key_pem: String

x5t_s256: String

Federated

Workload identity federation. token_file is where the platform projects the workload’s OIDC token — on Kubernetes this is the path AZURE_FEDERATED_TOKEN_FILE points at.

Fields

token_file: String

Trait Implementations

impl Clone for CredentialKind

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CredentialKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CredentialKind

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for CredentialKind

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.