sickn33/antigravity-awesome-skills/azure-identity-java

Name: azure-identity-java
Author: sickn33

Trust tier 2

community

Source check pending

Checking that the SKILL.md file is still in the repository.

Authenticate Java applications with Azure services using Microsoft Entra ID (Azure AD).

Install

npx vskill@latest install sickn33/antigravity-awesome-skills/azure-identity-java

SKILL.md

Azure Identity (Java)

Authenticate Java applications with Azure services using Microsoft Entra ID (Azure AD).

Installation

xml

<dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-identity</artifactId>
    <version>1.15.0</version>
</dependency>

Key Concepts

Credential	Use Case
`DefaultAzureCredential`	Recommended - Works in dev and production
`ManagedIdentityCredential`	Azure-hosted apps (App Service, Functions, VMs)
`EnvironmentCredential`	CI/CD pipelines with env vars
`ClientSecretCredential`	Service principals with secret
`ClientCertificateCredential`	Service principals with certificate
`AzureCliCredential`	Local dev using `az login`
`InteractiveBrowserCredential`	Interactive login flow
`DeviceCodeCredential`	Headless device authentication

DefaultAzureCredential (Recommended)

Pin SDK versions and verify the exact chain/features before use. For production, prefer the intended managed/workload identity explicitly or constrain the chain so ambient developer credentials cannot silently select another principal. Confirm tenant, resource endpoint and least-privilege role; secret values shown below are placeholders to load from approved storage, never literals to commit. Do not enable verbose/account logging by default.

The DefaultAzureCredential tries multiple authentication methods in order:

Environment variables
Workload Identity
Managed Identity
Azure CLI
Azure PowerShell
Azure Developer CLI

java

import com.azure.identity.DefaultAzureCredential;
import com.azure.identity.DefaultAzureCredentialBuilder;
 
// Simple usage
DefaultAzureCredential credential = new DefaultAzureCredentialBuilder().build();
 
// Use with any Azure client
BlobServiceClient blobClient = new BlobServiceClientBuilder()
    .endpoint("https://<storage-account>.blob.core.windows.net")
    .credential(credential)
    .buildClient();
 
KeyClient keyClient = new KeyClientBuilder()
    .vaultUrl("https://<vault-name>.vault.azure.net")
    .credential(credential)
    .buildClient();

Configure DefaultAzureCredential

java

DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
    .managedIdentityClientId("<user-assigned-identity-client-id>")  // For user-assigned MI
    .tenantId("<tenant-id>")                                        // Limit to specific tenant
    .excludeEnvironmentCredential()                                 // Skip env vars
    .excludeAzureCliCredential()                                    // Skip Azure CLI
    .build();

Managed Identity

For Azure-hosted applications (App Service, Functions, AKS, VMs).

java

import com.azure.identity.ManagedIdentityCredential;
import com.azure.identity.ManagedIdentityCredentialBuilder;
 
// System-assigned managed identity
ManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()
    .build();
 
// User-assigned managed identity (by client ID)
ManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()
    .clientId("<user-assigned-client-id>")
    .build();
 
// User-assigned managed identity (by resource ID)
ManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()
    .resourceId("/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>")
    .build();

Service Principal with Secret

java

import com.azure.identity.ClientSecretCredential;
import com.azure.identity.ClientSecretCredentialBuilder;
 
ClientSecretCredential credential = new ClientSecretCredentialBuilder()
    .tenantId("<tenant-id>")
    .clientId("<client-id>")
    .clientSecret("<client-secret>")
    .build();

Service Principal with Certificate

java

import com.azure.identity.ClientCertificateCredential;
import com.azure.identity.ClientCertificateCredentialBuilder;
 
// From PEM file
ClientCertificateCredential credential = new ClientCertificateCredentialBuilder()
    .tenantId("<tenant-id>")
    .clientId("<client-id>")
    .pemCertificate("<path-to-cert.pem>")
    .build();
 
// From PFX file with password
ClientCertificateCredential credential = new ClientCertificateCredentialBuilder()
    .tenantId("<tenant-id>")
    .clientId("<client-id>")
    .pfxCertificate("<path-to-cert.pfx>", "<pfx-password>")
    .build();
 
// Send certificate chain for SNI
ClientCertificateCredential credential = new ClientCertificateCredentialBuilder()
    .tenantId("<tenant-id>")
    .clientId("<client-id>")
    .pemCertificate("<path-to-cert.pem>")
    .sendCertificateChain(true)
    .build();

Environment Credential

Reads credentials from environment variables.

java

import com.azure.identity.EnvironmentCredential;
import com.azure.identity.EnvironmentCredentialBuilder;
 
EnvironmentCredential credential = new EnvironmentCredentialBuilder().build();

Required Environment Variables

For service principal with secret:

bash

AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_SECRET=<client-secret>

For service principal with certificate:

bash

AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_CERTIFICATE_PATH=/path/to/cert.pem
AZURE_CLIENT_CERTIFICATE_PASSWORD=<optional-password>

For username/password:

bash

AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_USERNAME=<username>
AZURE_PASSWORD=<password>

Azure CLI Credential

For local development using az login.

java

import com.azure.identity.AzureCliCredential;
import com.azure.identity.AzureCliCredentialBuilder;
 
AzureCliCredential credential = new AzureCliCredentialBuilder()
    .tenantId("<tenant-id>")  // Optional: specific tenant
    .build();

Interactive Browser

For desktop applications requiring user login.

java

import com.azure.identity.InteractiveBrowserCredential;
import com.azure.identity.InteractiveBrowserCredentialBuilder;
 
InteractiveBrowserCredential credential = new InteractiveBrowserCredentialBuilder()
    .clientId("<client-id>")
    .redirectUrl("http://localhost:8080")  // Must match app registration
    .build();

Device Code

For headless devices (IoT, CLI tools).

java

import com.azure.identity.DeviceCodeCredential;
import com.azure.identity.DeviceCodeCredentialBuilder;
 
DeviceCodeCredential credential = new DeviceCodeCredentialBuilder()
    .clientId("<client-id>")
    .challengeConsumer(challenge -> {
        // Display to user
        System.out.println(challenge.getMessage());
    })
    .build();

Chained Credential

Create custom authentication chains.

java

import com.azure.identity.ChainedTokenCredential;
import com.azure.identity.ChainedTokenCredentialBuilder;
 
ChainedTokenCredential credential = new ChainedTokenCredentialBuilder()
    .addFirst(new ManagedIdentityCredentialBuilder().build())
    .addLast(new AzureCliCredentialBuilder().build())
    .build();

Workload Identity (AKS)

For Azure Kubernetes Service with workload identity.

java

import com.azure.identity.WorkloadIdentityCredential;
import com.azure.identity.WorkloadIdentityCredentialBuilder;
 
// Reads from AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_FEDERATED_TOKEN_FILE
WorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder().build();
 
// Or explicit configuration
WorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder()
    .tenantId("<tenant-id>")
    .clientId("<client-id>")
    .tokenFilePath("/var/run/secrets/azure/tokens/azure-identity-token")
    .build();

Token Caching

Token caches depend on credential/version. Account-identifier logging is diagnostics, not cache enablement; it may expose account metadata. Configure persistent caching only through the supported credential-specific cache API and an approved protected store.

java

// Reuse a credential instance for supported in-memory token reuse
DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
    .build();
 
// With shared token cache (for multi-credential scenarios)
SharedTokenCacheCredential credential = new SharedTokenCacheCredentialBuilder()
    .clientId("<client-id>")
    .build();

Sovereign Clouds

java

import com.azure.identity.AzureAuthorityHosts;
 
// Azure Government
DefaultAzureCredential govCredential = new DefaultAzureCredentialBuilder()
    .authorityHost(AzureAuthorityHosts.AZURE_GOVERNMENT)
    .build();
 
// Azure China
DefaultAzureCredential chinaCredential = new DefaultAzureCredentialBuilder()
    .authorityHost(AzureAuthorityHosts.AZURE_CHINA)
    .build();

Error Handling

java

import com.azure.identity.CredentialUnavailableException;
import com.azure.core.exception.ClientAuthenticationException;
 
try {
    DefaultAzureCredential credential = new DefaultAzureCredentialBuilder().build();
    AccessToken token = credential.getTokenSync(new TokenRequestContext()
        .addScopes("https://management.azure.com/.default"));
} catch (CredentialUnavailableException e) {
    // No credential could authenticate
    System.out.println("Authentication failed: " + e.getMessage());
} catch (ClientAuthenticationException e) {
    // Authentication error (wrong credentials, expired, etc.)
    System.out.println("Auth error: " + e.getMessage());
}

Logging

Enable authentication logging for debugging.

java

// Via environment variable
// AZURE_LOG_LEVEL=verbose
 
// Or programmatically
DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
    .enableAccountIdentifierLogging()  // Log account info
    .build();

Environment Variables

bash

# DefaultAzureCredential configuration
AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_SECRET=<client-secret>
 
# Managed Identity
AZURE_CLIENT_ID=<user-assigned-mi-client-id>
 
# Workload Identity (AKS)
AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token
 
# Logging
AZURE_LOG_LEVEL=verbose
 
# Authority host
AZURE_AUTHORITY_HOST=https://login.microsoftonline.com/

Best Practices

Use DefaultAzureCredential - Works seamlessly from dev to production
Managed Identity in Production - No secrets to manage, automatic rotation
Azure CLI for Local Dev - Run az login before running your app
Least Privilege - Grant only required permissions to service principals
Token Caching - Enabled by default, reduces auth round-trips
Environment Variables - Use for CI/CD, not hardcoded secrets

Credential Selection Matrix

Environment	Recommended Credential
Local Development	`DefaultAzureCredential` (uses Azure CLI)
Azure App Service	`DefaultAzureCredential` (uses Managed Identity)
Azure Functions	`DefaultAzureCredential` (uses Managed Identity)
Azure Kubernetes Service	`WorkloadIdentityCredential`
Azure VMs	`DefaultAzureCredential` (uses Managed Identity)
CI/CD Pipeline	`EnvironmentCredential`
Desktop App	`InteractiveBrowserCredential`
CLI Tool	`DeviceCodeCredential`

Trigger Phrases

"Azure authentication Java", "DefaultAzureCredential Java"
"managed identity Java", "service principal Java"
"Azure login Java", "Azure credentials Java"
"AZURE_CLIENT_ID", "AZURE_TENANT_ID"

When to Use

This skill is applicable to execute the workflow or actions described in the overview.

Limitations

Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewPassed

See the full security report

Quality evaluation

Task evaluationPassed, 70 of 100Effective. 1 run. Evaluated 7 months ago.

See evaluation results

Source

SKILL.md in the repositoryCheckingskills/azure-identity-java/SKILL.md

Popularity

Repository stars: 26,144
Repository forks: 4,453
Repository npm downloads, 7 days: 11,772
7-day trend score: 72

Stars and forks are for the whole GitHub repository, not this skill alone. Downloads are for the repository's npm package. Refreshed 20 Mar 2026, 7 months ago.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/sickn33/antigravity-awesome-skills/azure-identity-java/badge)](https://verified-skill.com/skills/sickn33/antigravity-awesome-skills/azure-identity-java)

Something wrong with this skill or its page? Tell us.