Add Workload Identity Auth Support in KV JCA by g2vinay · Pull Request #47051 · Azure/azure-sdk-for-java

g2vinay · 2025-10-20T20:53:57Z

Adds Workload Identity Auth Support in KV JCA

Copilot

Pull Request Overview

This PR adds support for Azure Workload Identity authentication for Azure Kubernetes Service (AKS) workloads in the Key Vault JCA library. This enables credential-free authentication for AKS pods using federated tokens.

Key changes:

Implemented federated token-based authentication flow using environment variables (AZURE_FEDERATED_TOKEN_FILE, AZURE_CLIENT_ID, AZURE_TENANT_ID)
Added automatic detection and prioritization of Workload Identity authentication
Updated documentation with detailed authentication method examples and selection logic

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java	Added Workload Identity support with detection logic, token file reading, and OAuth2 client assertion flow implementation
sdk/keyvault/azure-security-keyvault-jca/README.md	Added comprehensive authentication method documentation with examples for Service Principal, Managed Identity, and Workload Identity
sdk/keyvault/azure-security-keyvault-jca/CHANGELOG.md	Documented new Workload Identity feature in the unreleased version section

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java

writemevenkat · 2025-11-14T20:49:06Z

Any ETA for this implementation ?

github-actions · 2026-01-16T05:08:55Z

Hi @g2vinay. Thank you for your interest in helping to improve the Azure SDK experience and for your contribution. We've noticed that there hasn't been recent engagement on this pull request. If this is still an active work stream, please let us know by pushing some changes or leaving a comment. Otherwise, we'll close this out in 7 days.

writemevenkat · 2026-01-16T14:20:12Z

Hi Azure SDK Team,

Our team is currently blocked from moving to AKS due to the absence of this feature. Please prioritize this enhancement, as it is critical for our migration plans. @g2vinay

sdk/keyvault/azure-security-keyvault-jca/README.md

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java

rujche

Please update the PR according to the comments and this PR: https://github.com/Azure/azure-sdk-for-java/pull/47749/files

github-actions · 2026-01-28T08:46:37Z

Hi @g2vinay. Thank you for your contribution. Since there hasn't been recent engagement, we're going to close this out. Feel free to respond with a comment containing /reopen if you'd like to continue working on these changes. Please be sure to use the command to reopen or remove the no-recent-activity label; otherwise, this is likely to be closed again with the next cleanup pass.

writemevenkat · 2026-01-28T14:59:18Z

Hi @g2vinay, @rujche - I’m not sure why this PR was auto-closed even though there was recent activity. Could you please take a look and continue/reopen it? We’ve been waiting for this feature to be available.

github-actions · 2026-01-28T14:59:36Z

Sorry, @writemevenkat, only the original author can reopen this pull request.

rujche · 2026-01-29T06:09:09Z

Hi, @g2vinay I opened this PR. Could you please update this PR when you have time?

rujche · 2026-01-29T07:59:22Z

sdk/keyvault/azure-security-keyvault-jca/README.md

Please add another auth type from here: #47850

Again, please add the auth type of access token. And sort them by priority.

g2vinay · 2026-01-29T08:01:51Z

Thanks @rujche for the feedback, I will be addressing the feedback today for this PR.

g2vinay · 2026-01-29T08:04:53Z

Hi @g2vinay, @rujche - I’m not sure why this PR was auto-closed even though there was recent activity. Could you please take a look and continue/reopen it? We’ve been waiting for this feature to be available.

Thanks for following up on this feature.
We will get this PR merged sometime early to mid next week.

From there on @rujche will release this as part of next scheduled release I believe.

rujche · 2026-02-02T02:34:51Z

Hi, @g2vinay , could you please resolve the conflicts in this PR?

…ty-support-kvjca

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java

...eyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/KeyVaultClient.java

rujche · 2026-02-03T09:18:29Z

...eyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/KeyVaultClient.java

                    = AccessTokenUtil.getAccessToken(resource, aadAuthenticationUri, tenantId, clientId, clientSecret);
+            } else if (AccessTokenUtil.isWorkloadIdentityAvailable()) {
+                accessToken
+                    = AccessTokenUtil.getAccessTokenWithWorkloadIdentity(keyVaultBaseUri, tenantId, clientId, null);


Have you test it? If you have tested it, could you please share the screenshot to improve that it worked?

End to end testing, requires resources setup, that is what I am currently working on.

rujche · 2026-02-03T09:19:48Z

sdk/keyvault/azure-security-keyvault-jca/README.md

Again, please add the auth type of access token. And sort them by priority.

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java

sdk/keyvault/azure-security-keyvault-jca/CHANGELOG.md

add workload identity support

e173f37

github-actions bot added the azure-spring All azure-spring related issues label Oct 20, 2025

update README

56b5485

g2vinay marked this pull request as ready for review November 4, 2025 07:05

g2vinay requested a review from rujche as a code owner November 4, 2025 07:05

Copilot AI review requested due to automatic review settings November 4, 2025 07:05

g2vinay requested review from a team, Netyyyy, moarychan and saragluna as code owners November 4, 2025 07:05

Copilot AI reviewed Nov 4, 2025

View reviewed changes

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java Outdated Show resolved Hide resolved

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java Outdated Show resolved Hide resolved

thomob reviewed Nov 6, 2025

View reviewed changes

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java Outdated Show resolved Hide resolved

github-actions bot added the no-recent-activity There has been no recent activity on this issue. label Jan 16, 2026

thomob mentioned this pull request Jan 20, 2026

Add support for Workload Identity authentication in azure-security-keyvault-jca #47749

Open

6 tasks

rujche reviewed Jan 21, 2026

View reviewed changes

sdk/keyvault/azure-security-keyvault-jca/README.md Show resolved Hide resolved

rujche reviewed Jan 21, 2026

View reviewed changes

sdk/keyvault/azure-security-keyvault-jca/README.md Outdated Show resolved Hide resolved

rujche reviewed Jan 21, 2026

View reviewed changes

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java Outdated Show resolved Hide resolved

rujche reviewed Jan 21, 2026

View reviewed changes

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java Outdated Show resolved Hide resolved

rujche reviewed Jan 21, 2026

View reviewed changes

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java Outdated Show resolved Hide resolved

rujche requested changes Jan 21, 2026

View reviewed changes

rujche assigned g2vinay and rujche Jan 21, 2026

rujche added this to Spring Cloud Azure Jan 21, 2026

github-project-automation bot moved this from Todo to In Progress in Spring Cloud Azure Jan 21, 2026

github-project-automation bot moved this to Todo in Spring Cloud Azure Jan 21, 2026

rujche added this to the 2026-02 milestone Jan 21, 2026

github-actions bot closed this Jan 28, 2026

github-project-automation bot moved this from In Progress to Done in Spring Cloud Azure Jan 28, 2026

rujche reopened this Jan 29, 2026

github-project-automation bot moved this from Done to In Progress in Spring Cloud Azure Jan 29, 2026

github-actions bot removed the no-recent-activity There has been no recent activity on this issue. label Jan 29, 2026

rujche mentioned this pull request Jan 29, 2026

Support azure.keyvault.access-token in azure-security-keyvault-jca #47850

Merged

17 tasks

rujche reviewed Jan 29, 2026

View reviewed changes

Address feedback + add tests

de88571

g2vinay added 2 commits February 2, 2026 23:51

Merge remote-tracking branch 'upstream/main' into add-workload-identi…

9a69839

…ty-support-kvjca

resolve conflicts

d6e3a8e

thomob reviewed Feb 3, 2026

View reviewed changes

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java Outdated Show resolved Hide resolved

rujche requested changes Feb 3, 2026

View reviewed changes

thomob reviewed Feb 3, 2026

View reviewed changes

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java Outdated Show resolved Hide resolved

thomob reviewed Feb 3, 2026

View reviewed changes

...-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java Outdated Show resolved Hide resolved

thomob reviewed Feb 3, 2026

View reviewed changes

sdk/keyvault/azure-security-keyvault-jca/CHANGELOG.md Outdated Show resolved Hide resolved

g2vinay added 4 commits February 3, 2026 19:27

addres feedback

14acbb9

address feedback

16e210e

spotless fix

180ebe2

update README

bf26cfc

Conversation

g2vinay commented Oct 20, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

writemevenkat commented Nov 14, 2025

Uh oh!

github-actions bot commented Jan 16, 2026

Uh oh!

writemevenkat commented Jan 16, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rujche left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

writemevenkat commented Jan 28, 2026

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

rujche commented Jan 29, 2026

Uh oh!

rujche Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

rujche Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

g2vinay Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

g2vinay commented Jan 29, 2026

Uh oh!

g2vinay commented Jan 29, 2026

Uh oh!

rujche commented Feb 2, 2026

Uh oh!

Uh oh!

Uh oh!

rujche Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

g2vinay Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

rujche Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants