Package org.cibseven.bpm.client.interceptor.auth

Class AzureWorkloadIdentityAssertionProvider

java.lang.Object

org.cibseven.bpm.client.interceptor.auth.AzureWorkloadIdentityAssertionProvider

All Implemented Interfaces:

ClientAssertionProvider

public class AzureWorkloadIdentityAssertionProvider
extends Object
implements ClientAssertionProvider

Supplies a federated identity token for Azure Workload Identity authentication.

Azure Workload Identity injects a file containing a short-lived service account token (signed by the Kubernetes OIDC issuer) into the workload pod. This token can be exchanged for an Azure Entra ID access token via the urn:ietf:params:oauth:client-assertion-type:jwt-bearer mechanism.

The file path is read from the AZURE_FEDERATED_TOKEN_FILE environment variable, which is injected automatically by the Azure Workload Identity mutating webhook. The file is re-read on every getAssertion() call because Azure rotates the token periodically.

Required environment variable:

• AZURE_FEDERATED_TOKEN_FILE — absolute path to the projected token file (e.g. /var/run/secrets/azure/tokens/azure-identity-token)

Field Summary

Fields

Modifier and Type	Field	Description
protected static final String	ENV_FEDERATED_TOKEN_FILE

Constructor Summary

Constructors

Constructor	Description
AzureWorkloadIdentityAssertionProvider()

Method Summary

Modifier and Type	Method	Description
String	getAssertion()	Reads and returns the federated identity token from the file path referenced by the AZURE_FEDERATED_TOKEN_FILE environment variable.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

ENV_FEDERATED_TOKEN_FILE

protected static final String ENV_FEDERATED_TOKEN_FILE

See Also:

• Constant Field Values

Constructor Details

AzureWorkloadIdentityAssertionProvider

public AzureWorkloadIdentityAssertionProvider()

Method Details

getAssertion

public String getAssertion()

Reads and returns the federated identity token from the file path referenced by the AZURE_FEDERATED_TOKEN_FILE environment variable.

The file is read fresh on every call because Azure Workload Identity rotates the token file automatically.

Specified by:

getAssertion in interface ClientAssertionProvider

Returns:

the raw federated token string (used directly as client_assertion)

Throws:

ExternalTaskClientException - if the environment variable is not set or the file cannot be read