Struct AzureCredentialIssuer 

pub struct AzureCredentialIssuer { /* private fields */ }

Issues short-lived Azure credentials via AzureCliCredential.

Works with Azure CLI credentials (az login). For other auth methods (service principals, managed identity), use the appropriate credential type from azure_identity.

Implementations

impl AzureCredentialIssuer

pub fn new() -> Result<Self>

Create a new issuer using AzureCliCredential. Requires az login to have been run.

pub async fn issue(&self, ttl: Duration) -> Result<AzureTempCredentials>

Get an access token for Azure Resource Manager.

The token is scoped to the ARM management API. The endpoint is derived from the AZURE_CLOUD env var to support sovereign clouds:

• AzureCloud (default): management.azure.com
• AzureUSGovernment: management.usgovcloudapi.net
• AzureChinaCloud: management.chinacloudapi.cn

Azure tokens are typically valid for 1 hour. The ttl parameter controls session metadata only — Azure does not support shorter-lived tokens on the client side. If ttl is shorter than the token’s actual expiry, expires_at is set to now + ttl so audex treats the session as expired at the requested time.

pub async fn issue_with_optional_scope( &self, scope: Option<&str>, ttl: Duration, ) -> Result<AzureTempCredentials>

Unified issuance that picks issue_for_scope when a scope is provided and issue otherwise. Used by the rotation closure so rotated tokens always target the same audience as the initially issued token (R6-H8).

pub async fn issue_for_scope( &self, scope: &str, ttl: Duration, ) -> Result<AzureTempCredentials>

Get an access token for a specific Azure service scope. Scope must be an https:// URL whose domain is an allowed Azure authority (see AZURE_ALLOWED_SCOPE_DOMAINS).