@azure/identity 3.2.0-alpha.20230213.2 → 3.2.0-alpha.20230227.4

package/dist/index.js

@@ -14,10 +14,11 @@ var coreTracing = require('@azure/core-tracing');
 var fs = require('fs');
 var os = require('os');
 var path = require('path');
-var util = require('util');
+var promises = require('fs/promises');
 var https = require('https');
 var child_process = require('child_process');
 var crypto = require('crypto');
+var util = require('util');
 var http = require('http');
 var open = require('open');
 var stoppable = require('stoppable');
@@ -553,6 +554,7 @@ function processMultiTenantRequest(tenantId, getTokenOptions, additionallyAllowe
     else {
         resolvedTenantId = (_a = getTokenOptions === null || getTokenOptions === void 0 ? void 0 : getTokenOptions.tenantId) !== null && _a !== void 0 ? _a : tenantId;
     }
+    console.log(resolvedTenantId);
     if (tenantId &&
         resolvedTenantId !== tenantId &&
         !additionallyAllowedTenantIds.includes("*") &&
@@ -724,6 +726,8 @@ class IdentityClient extends coreClient.ServiceClient {
         this.authorityHost = baseUri;
         this.abortControllers = new Map();
         this.allowLoggingAccountIdentifiers = (_b = options === null || options === void 0 ? void 0 : options.loggingOptions) === null || _b === void 0 ? void 0 : _b.allowLoggingAccountIdentifiers;
+        // used for WorkloadIdentity
+        this.tokenCredentialOptions = Object.assign({}, options);
     }
     async sendTokenRequest(request) {
         logger$m.info(`IdentityClient: sending token request to [${request.url}]`);
@@ -869,6 +873,13 @@ class IdentityClient extends coreClient.ServiceClient {
             status: response.status,
         };
     }
+    /**
+     *
+     * @internal
+     */
+    getTokenCredentialOptions() {
+        return this.tokenCredentialOptions;
+    }
     /**
      * If allowLoggingAccountIdentifiers was set on the constructor options
      * we try to log the account identifiers by parsing the received access token.
@@ -1479,7 +1490,7 @@ const logger$k = credentialLogger(msiName$6);
 /**
  * Generates the options used on the request for an access token.
  */
-function prepareRequestOptions$6(scopes, clientId) {
+function prepareRequestOptions$5(scopes, clientId) {
     const resource = mapScopesToResource(scopes);
     if (!resource) {
         throw new Error(`${msiName$6}: Multiple scopes are not supported.`);
@@ -1512,6 +1523,7 @@ function prepareRequestOptions$6(scopes, clientId) {
  * Defines how to determine whether the Azure App Service MSI is available, and also how to retrieve a token from the Azure App Service MSI.
  */
 const appServiceMsi2017 = {
+    name: "appServiceMsi2017",
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
@@ -1531,7 +1543,7 @@ const appServiceMsi2017 = {
             logger$k.warning(`${msiName$6}: managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
         }
         logger$k.info(`${msiName$6}: Using the endpoint and the secret coming form the environment variables: MSI_ENDPOINT=${process.env.MSI_ENDPOINT} and MSI_SECRET=[REDACTED].`);
-        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$6(scopes, clientId)), { 
+        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$5(scopes, clientId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request);
@@ -1545,7 +1557,7 @@ const logger$j = credentialLogger(msiName$5);
 /**
  * Generates the options used on the request for an access token.
  */
-function prepareRequestOptions$5(scopes, clientId, resourceId) {
+function prepareRequestOptions$4(scopes, clientId, resourceId) {
     const resource = mapScopesToResource(scopes);
     if (!resource) {
         throw new Error(`${msiName$5}: Multiple scopes are not supported.`);
@@ -1580,6 +1592,7 @@ function prepareRequestOptions$5(scopes, clientId, resourceId) {
  * Since Azure Managed Identities aren't available in the Azure Cloud Shell, we log a warning for users that try to access cloud shell using user assigned identity.
  */
 const cloudShellMsi = {
+    name: "cloudShellMsi",
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
@@ -1601,7 +1614,7 @@ const cloudShellMsi = {
             logger$j.warning(`${msiName$5}: user defined managed Identity by resource Id not supported. The argument resourceId might be ignored by the service.`);
         }
         logger$j.info(`${msiName$5}: Using the endpoint coming form the environment variable MSI_ENDPOINT = ${process.env.MSI_ENDPOINT}.`);
-        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$5(scopes, clientId, resourceId)), { 
+        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$4(scopes, clientId, resourceId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request);
@@ -1615,7 +1628,7 @@ const logger$i = credentialLogger(msiName$4);
 /**
  * Generates the options used on the request for an access token.
  */
-function prepareRequestOptions$4(scopes, clientId, resourceId, options) {
+function prepareRequestOptions$3(scopes, clientId, resourceId, options) {
     var _a;
     const resource = mapScopesToResource(scopes);
     if (!resource) {
@@ -1665,6 +1678,7 @@ const imdsMsiRetryConfig = {
  * Defines how to determine whether the Azure IMDS MSI is available, and also how to retrieve a token from the Azure IMDS MSI.
  */
 const imdsMsi = {
+    name: "imdsMsi",
     async isAvailable({ scopes, identityClient, clientId, resourceId, getTokenOptions = {}, }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
@@ -1678,7 +1692,7 @@ const imdsMsi = {
         if (!identityClient) {
             throw new Error("Missing IdentityClient");
         }
-        const requestOptions = prepareRequestOptions$4(resource, clientId, resourceId, {
+        const requestOptions = prepareRequestOptions$3(resource, clientId, resourceId, {
             skipMetadataHeader: true,
             skipQuery: true,
         });
@@ -1723,7 +1737,7 @@ const imdsMsi = {
         let nextDelayInMs = imdsMsiRetryConfig.startDelayInMs;
         for (let retries = 0; retries < imdsMsiRetryConfig.maxRetries; retries++) {
             try {
-                const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$4(scopes, clientId, resourceId)), { allowInsecureConnection: true }));
+                const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$3(scopes, clientId, resourceId)), { allowInsecureConnection: true }));
                 const tokenResponse = await identityClient.sendTokenRequest(request);
                 return (tokenResponse && tokenResponse.accessToken) || null;
             }
@@ -1746,7 +1760,7 @@ const logger$h = credentialLogger(msiName$3);
 /**
  * Generates the options used on the request for an access token.
  */
-function prepareRequestOptions$3(scopes, clientId, resourceId) {
+function prepareRequestOptions$2(scopes, clientId, resourceId) {
     const resource = mapScopesToResource(scopes);
     if (!resource) {
         throw new Error(`${msiName$3}: Multiple scopes are not supported.`);
@@ -1780,7 +1794,7 @@ function prepareRequestOptions$3(scopes, clientId, resourceId) {
  * Retrieves the file contents at the given path using promises.
  * Useful since `fs`'s readFileSync locks the thread, and to avoid extra dependencies.
  */
-function readFileAsync$2(path, options) {
+function readFileAsync$1(path, options) {
     return new Promise((resolve, reject) => fs.readFile(path, options, (err, data) => {
         if (err) {
             reject(err);
@@ -1812,6 +1826,7 @@ async function filePathRequest(identityClient, requestPrepareOptions) {
  * Defines how to determine whether the Azure Arc MSI is available, and also how to retrieve a token from the Azure Arc MSI.
  */
 const arcMsi = {
+    name: "arc",
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
@@ -1834,12 +1849,12 @@ const arcMsi = {
             logger$h.warning(`${msiName$3}: user defined managed Identity by resource Id is not supported. Argument resourceId will be ignored.`);
         }
         logger$h.info(`${msiName$3}: Authenticating.`);
-        const requestOptions = Object.assign(Object.assign({ disableJsonStringifyOnBody: true, deserializationMapper: undefined, abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$3(scopes, clientId, resourceId)), { allowInsecureConnection: true });
+        const requestOptions = Object.assign(Object.assign({ disableJsonStringifyOnBody: true, deserializationMapper: undefined, abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$2(scopes, clientId, resourceId)), { allowInsecureConnection: true });
         const filePath = await filePathRequest(identityClient, requestOptions);
         if (!filePath) {
             throw new Error(`${msiName$3}: Failed to find the token file.`);
         }
-        const key = await readFileAsync$2(filePath, { encoding: "utf-8" });
+        const key = await readFileAsync$1(filePath, { encoding: "utf-8" });
         (_a = requestOptions.headers) === null || _a === void 0 ? void 0 : _a.set("Authorization", `Basic ${key}`);
         const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({}, requestOptions), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
@@ -1850,82 +1865,164 @@ const arcMsi = {
 };
 
 // Copyright (c) Microsoft Corporation.
-const msiName$2 = "ManagedIdentityCredential - Token Exchange";
-const logger$g = credentialLogger(msiName$2);
-const readFileAsync$1 = util.promisify(fs__default["default"].readFile);
 /**
- * Generates the options used on the request for an access token.
+ * MSAL client assertion client. Calls to MSAL's confidential application's `acquireTokenByClientCredential` during `doGetToken`.
+ * @internal
  */
-function prepareRequestOptions$2(scopes, clientAssertion, clientId) {
-    var _a;
-    const bodyParams = {
-        scope: Array.isArray(scopes) ? scopes.join(" ") : scopes,
-        client_assertion: clientAssertion,
-        client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
-        client_id: clientId,
-        grant_type: "client_credentials",
-    };
-    const urlParams = new URLSearchParams(bodyParams);
-    const url = new URL(`${process.env.AZURE_TENANT_ID}/oauth2/v2.0/token`, (_a = process.env.AZURE_AUTHORITY_HOST) !== null && _a !== void 0 ? _a : DefaultAuthorityHost);
-    return {
-        url: url.toString(),
-        method: "POST",
-        body: urlParams.toString(),
-        headers: coreRestPipeline.createHttpHeaders({
-            Accept: "application/json",
-        }),
-    };
+class MsalClientAssertion extends MsalNode {
+    constructor(options) {
+        super(options);
+        this.requiresConfidential = true;
+        this.getAssertion = options.getAssertion;
+    }
+    async doGetToken(scopes, options = {}) {
+        try {
+            const assertion = await this.getAssertion();
+            const result = await this.confidentialApp.acquireTokenByClientCredential({
+                scopes,
+                correlationId: options.correlationId,
+                azureRegion: this.azureRegion,
+                authority: options.authority,
+                claims: options.claims,
+                clientAssertion: assertion,
+            });
+            // The Client Credential flow does not return an account,
+            // so each time getToken gets called, we will have to acquire a new token through the service.
+            return this.handleResult(scopes, this.clientId, result || undefined);
+        }
+        catch (err) {
+            let err2 = err;
+            if (err === null || err === undefined) {
+                err2 = new Error(JSON.stringify(err));
+            }
+            else {
+                err2 = coreUtil.isError(err) ? err : new Error(String(err));
+            }
+            throw this.handleError(scopes, err2, options);
+        }
+    }
 }
+
+// Copyright (c) Microsoft Corporation.
+const logger$g = credentialLogger("ClientAssertionCredential");
 /**
- * Defines how to determine whether the token exchange MSI is available, and also how to retrieve a token from the token exchange MSI.
+ * Authenticates a service principal with a JWT assertion.
  */
-function tokenExchangeMsi() {
-    const azureFederatedTokenFilePath = process.env.AZURE_FEDERATED_TOKEN_FILE;
-    let azureFederatedTokenFileContent = undefined;
-    let cacheDate = undefined;
-    // Only reads from the assertion file once every 5 minutes
-    async function readAssertion() {
+class ClientAssertionCredential {
+    /**
+     * Creates an instance of the ClientAssertionCredential with the details
+     * needed to authenticate against Azure Active Directory with a client
+     * assertion provided by the developer through the `getAssertion` function parameter.
+     *
+     * @param tenantId - The Azure Active Directory tenant (directory) ID.
+     * @param clientId - The client (application) ID of an App Registration in the tenant.
+     * @param getAssertion - A function that retrieves the assertion for the credential to use.
+     * @param options - Options for configuring the client which makes the authentication request.
+     */
+    constructor(tenantId, clientId, getAssertion, options = {}) {
+        if (!tenantId || !clientId || !getAssertion) {
+            throw new Error("ClientAssertionCredential: tenantId, clientId, and clientAssertion are required parameters.");
+        }
+        this.tenantId = tenantId;
+        this.additionallyAllowedTenantIds = resolveAddionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.clientId = clientId;
+        this.options = options;
+        this.msalFlow = new MsalClientAssertion(Object.assign(Object.assign({}, options), { logger: logger$g, clientId: this.clientId, tenantId: this.tenantId, tokenCredentialOptions: this.options, getAssertion }));
+    }
+    /**
+     * Authenticates with Azure Active Directory and returns an access token if successful.
+     * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
+     *
+     * @param scopes - The list of scopes for which the token will have access.
+     * @param options - The options used to configure any requests this
+     *                TokenCredential implementation might make.
+     */
+    async getToken(scopes, options = {}) {
+        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
+            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds);
+            const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
+            return this.msalFlow.getToken(arrayScopes, newOptions);
+        });
+    }
+}
+
+// Copyright (c) Microsoft Corporation.
+/**
+ * WorkloadIdentityCredential supports Azure workload identity authentication on Kubernetes.
+ * Refer to <a href="https://learn.microsoft.com/azure/aks/workload-identity-overview">Azure Active Directory Workload Identity</a>
+ * for more information.
+ */
+class WorkloadIdentityCredential {
+    /**
+     * WorkloadIdentityCredential supports Azure workload identity on Kubernetes.
+     *
+     * @param options - The identity client options to use for authentication.
+     */
+    constructor(options = {}) {
+        this.azureFederatedTokenFileContent = undefined;
+        this.cacheDate = undefined;
+        if (!options.tenantId || !options.clientId || !options.federatedTokenFilePath) {
+            throw new Error("WorkloadIdentityCredential: tenantId, clientId, and federatedTokenFilePath are required parameters.");
+        }
+        this.federatedTokenFilePath = options.federatedTokenFilePath;
+        this.client = new ClientAssertionCredential(options.tenantId, options.clientId, this.readFileContents.bind(this), options);
+    }
+    /**
+     * Authenticates with Azure Active Directory and returns an access token if successful.
+     * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
+     *
+     * @param scopes - The list of scopes for which the token will have access.
+     * @param options - The options used to configure any requests this
+     *                TokenCredential implementation might make.
+     */
+    getToken(scopes, options) {
+        return this.client.getToken(scopes, options);
+    }
+    async readFileContents() {
         // Cached assertions expire after 5 minutes
-        if (cacheDate !== undefined && Date.now() - cacheDate >= 1000 * 60 * 5) {
-            azureFederatedTokenFileContent = undefined;
+        if (this.cacheDate !== undefined && Date.now() - this.cacheDate >= 1000 * 60 * 5) {
+            this.azureFederatedTokenFileContent = undefined;
         }
-        if (!azureFederatedTokenFileContent) {
-            const file = await readFileAsync$1(azureFederatedTokenFilePath, "utf8");
+        if (!this.azureFederatedTokenFileContent) {
+            const file = await promises.readFile(this.federatedTokenFilePath, "utf8");
             const value = file.trim();
             if (!value) {
-                throw new Error(`No content on the file ${azureFederatedTokenFilePath}, indicated by the environment variable AZURE_FEDERATED_TOKEN_FILE`);
+                throw new Error(`No content on the file ${this.federatedTokenFilePath}.`);
             }
             else {
-                azureFederatedTokenFileContent = value;
-                cacheDate = Date.now();
+                this.azureFederatedTokenFileContent = value;
+                this.cacheDate = Date.now();
             }
         }
-        return azureFederatedTokenFileContent;
+        return this.azureFederatedTokenFileContent;
     }
+}
+
+// Copyright (c) Microsoft Corporation.
+const msiName$2 = "ManagedIdentityCredential - Token Exchange";
+const logger$f = credentialLogger(msiName$2);
+/**
+ * Defines how to determine whether the token exchange MSI is available, and also how to retrieve a token from the token exchange MSI.
+ */
+function tokenExchangeMsi() {
     return {
+        name: "tokenExchangeMsi",
         async isAvailable({ clientId }) {
             const env = process.env;
-            const result = Boolean((clientId || env.AZURE_CLIENT_ID) && env.AZURE_TENANT_ID && azureFederatedTokenFilePath);
+            const result = Boolean((clientId || env.AZURE_CLIENT_ID) &&
+                env.AZURE_TENANT_ID &&
+                process.env.AZURE_FEDERATED_TOKEN_FILE);
             if (!result) {
-                logger$g.info(`${msiName$2}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`);
+                logger$f.info(`${msiName$2}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`);
             }
             return result;
         },
         async getToken(configuration, getTokenOptions = {}) {
-            const { identityClient, scopes, clientId } = configuration;
-            logger$g.info(`${msiName$2}: Using the client assertion coming from environment variables.`);
-            let assertion;
-            try {
-                assertion = await readAssertion();
-            }
-            catch (err) {
-                throw new Error(`${msiName$2}: Failed to read ${azureFederatedTokenFilePath}, indicated by the environment variable AZURE_FEDERATED_TOKEN_FILE`);
-            }
-            const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$2(scopes, assertion, clientId || process.env.AZURE_CLIENT_ID)), { 
-                // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
-                allowInsecureConnection: true }));
-            const tokenResponse = await identityClient.sendTokenRequest(request);
-            return (tokenResponse && tokenResponse.accessToken) || null;
+            const { scopes, clientId } = configuration;
+            const identityClientTokenCredentialOptions = {};
+            const workloadIdentityCredential = new WorkloadIdentityCredential(Object.assign(Object.assign({ clientId, tenantId: process.env.AZURE_TENANT_ID, federatedTokenFilePath: process.env.AZURE_FEDERATED_TOKEN_FILE }, identityClientTokenCredentialOptions), { disableInstanceDiscovery: true }));
+            const token = await workloadIdentityCredential.getToken(scopes, getTokenOptions);
+            return token;
         },
     };
 }
@@ -1942,7 +2039,7 @@ function tokenExchangeMsi() {
 //   curl --insecure $IDENTITY_ENDPOINT'?api-version=2019-07-01-preview&resource=https://vault.azure.net/' -H "Secret: $IDENTITY_HEADER"
 //
 const msiName$1 = "ManagedIdentityCredential - Fabric MSI";
-const logger$f = credentialLogger(msiName$1);
+const logger$e = credentialLogger(msiName$1);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -1982,25 +2079,26 @@ function prepareRequestOptions$1(scopes, clientId, resourceId) {
  * Defines how to determine whether the Azure Service Fabric MSI is available, and also how to retrieve a token from the Azure Service Fabric MSI.
  */
 const fabricMsi = {
+    name: "fabricMsi",
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$f.info(`${msiName$1}: Unavailable. Multiple scopes are not supported.`);
+            logger$e.info(`${msiName$1}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.IDENTITY_ENDPOINT && env.IDENTITY_HEADER && env.IDENTITY_SERVER_THUMBPRINT);
         if (!result) {
-            logger$f.info(`${msiName$1}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT, IDENTITY_HEADER and IDENTITY_SERVER_THUMBPRINT`);
+            logger$e.info(`${msiName$1}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT, IDENTITY_HEADER and IDENTITY_SERVER_THUMBPRINT`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { scopes, identityClient, clientId, resourceId } = configuration;
         if (resourceId) {
-            logger$f.warning(`${msiName$1}: user defined managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
+            logger$e.warning(`${msiName$1}: user defined managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
         }
-        logger$f.info([
+        logger$e.info([
             `${msiName$1}:`,
             "Using the endpoint and the secret coming from the environment variables:",
             `IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT},`,
@@ -2020,7 +2118,7 @@ const fabricMsi = {
 
 // Copyright (c) Microsoft Corporation.
 const msiName = "ManagedIdentityCredential - AppServiceMSI 2019";
-const logger$e = credentialLogger(msiName);
+const logger$d = credentialLogger(msiName);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -2060,22 +2158,23 @@ function prepareRequestOptions(scopes, clientId, resourceId) {
  * Defines how to determine whether the Azure App Service MSI is available, and also how to retrieve a token from the Azure App Service MSI.
  */
 const appServiceMsi2019 = {
+    name: "appServiceMsi2019",
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$e.info(`${msiName}: Unavailable. Multiple scopes are not supported.`);
+            logger$d.info(`${msiName}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.IDENTITY_ENDPOINT && env.IDENTITY_HEADER);
         if (!result) {
-            logger$e.info(`${msiName}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT and IDENTITY_HEADER.`);
+            logger$d.info(`${msiName}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT and IDENTITY_HEADER.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
-        logger$e.info(`${msiName}: Using the endpoint and the secret coming form the environment variables: IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT} and IDENTITY_HEADER=[REDACTED].`);
+        logger$d.info(`${msiName}: Using the endpoint and the secret coming form the environment variables: IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT} and IDENTITY_HEADER=[REDACTED].`);
         const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions(scopes, clientId, resourceId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
@@ -2085,7 +2184,7 @@ const appServiceMsi2019 = {
 };
 
 // Copyright (c) Microsoft Corporation.
-const logger$d = credentialLogger("ManagedIdentityCredential");
+const logger$c = credentialLogger("ManagedIdentityCredential");
 /**
  * Attempts authentication using a managed identity available at the deployment environment.
  * This authentication type works in Azure VMs, App Service instances, Azure Functions applications,
@@ -2199,35 +2298,41 @@ class ManagedIdentityCredential {
             // If it's null, it means we don't yet know whether
             // the endpoint is available and need to check for it.
             if (this.isEndpointUnavailable !== true) {
-                const appTokenParameters = {
-                    correlationId: this.identityClient.getCorrelationId(),
-                    tenantId: (options === null || options === void 0 ? void 0 : options.tenantId) || "organizations",
-                    scopes: Array.isArray(scopes) ? scopes : [scopes],
-                    claims: options === null || options === void 0 ? void 0 : options.claims,
-                };
-                this.confidentialApp.SetAppTokenProvider(async (appTokenProviderParameters = appTokenParameters) => {
-                    logger$d.info(`SetAppTokenProvider invoked with parameters- ${JSON.stringify(appTokenProviderParameters)}`);
-                    const resultToken = await this.authenticateManagedIdentity(scopes, Object.assign(Object.assign({}, updatedOptions), appTokenProviderParameters));
-                    if (resultToken) {
-                        logger$d.info(`SetAppTokenProvider has saved the token in cache`);
-                        const expiresInSeconds = (resultToken === null || resultToken === void 0 ? void 0 : resultToken.expiresOnTimestamp)
-                            ? Math.floor((resultToken.expiresOnTimestamp - Date.now()) / 1000)
-                            : 0;
-                        return {
-                            accessToken: resultToken === null || resultToken === void 0 ? void 0 : resultToken.token,
-                            expiresInSeconds,
-                        };
-                    }
-                    else {
-                        logger$d.info(`SetAppTokenProvider token has "no_access_token_returned" as the saved token`);
-                        return {
-                            accessToken: "no_access_token_returned",
-                            expiresInSeconds: 0,
-                        };
-                    }
-                });
-                const authenticationResult = await this.confidentialApp.acquireTokenByClientCredential(Object.assign({}, appTokenParameters));
-                result = this.handleResult(scopes, authenticationResult || undefined);
+                const availableMSI = await this.cachedAvailableMSI(scopes, updatedOptions);
+                if (availableMSI.name === "tokenExchangeMsi") {
+                    result = await this.authenticateManagedIdentity(scopes, updatedOptions);
+                }
+                else {
+                    const appTokenParameters = {
+                        correlationId: this.identityClient.getCorrelationId(),
+                        tenantId: (options === null || options === void 0 ? void 0 : options.tenantId) || "organizations",
+                        scopes: Array.isArray(scopes) ? scopes : [scopes],
+                        claims: options === null || options === void 0 ? void 0 : options.claims,
+                    };
+                    this.confidentialApp.SetAppTokenProvider(async (appTokenProviderParameters = appTokenParameters) => {
+                        logger$c.info(`SetAppTokenProvider invoked with parameters- ${JSON.stringify(appTokenProviderParameters)}`);
+                        const resultToken = await this.authenticateManagedIdentity(scopes, Object.assign(Object.assign({}, updatedOptions), appTokenProviderParameters));
+                        if (resultToken) {
+                            logger$c.info(`SetAppTokenProvider has saved the token in cache`);
+                            const expiresInSeconds = (resultToken === null || resultToken === void 0 ? void 0 : resultToken.expiresOnTimestamp)
+                                ? Math.floor((resultToken.expiresOnTimestamp - Date.now()) / 1000)
+                                : 0;
+                            return {
+                                accessToken: resultToken === null || resultToken === void 0 ? void 0 : resultToken.token,
+                                expiresInSeconds,
+                            };
+                        }
+                        else {
+                            logger$c.info(`SetAppTokenProvider token has "no_access_token_returned" as the saved token`);
+                            return {
+                                accessToken: "no_access_token_returned",
+                                expiresInSeconds: 0,
+                            };
+                        }
+                    });
+                    const authenticationResult = await this.confidentialApp.acquireTokenByClientCredential(Object.assign({}, appTokenParameters));
+                    result = this.handleResult(scopes, authenticationResult || undefined);
+                }
                 if (result === null) {
                     // If authenticateManagedIdentity returns null,
                     // it means no MSI endpoints are available.
@@ -2236,7 +2341,7 @@ class ManagedIdentityCredential {
                     // It also means that the endpoint answered with either 200 or 201 (see the sendTokenRequest method),
                     // yet we had no access token. For this reason, we'll throw once with a specific message:
                     const error = new CredentialUnavailableError("The managed identity endpoint was reached, yet no tokens were received.");
-                    logger$d.getToken.info(formatError(scopes, error));
+                    logger$c.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 // Since `authenticateManagedIdentity` didn't throw, and the result was not null,
@@ -2248,10 +2353,10 @@ class ManagedIdentityCredential {
                 // We've previously determined that the endpoint was unavailable,
                 // either because it was unreachable or permanently unable to authenticate.
                 const error = new CredentialUnavailableError("The managed identity endpoint is not currently available");
-                logger$d.getToken.info(formatError(scopes, error));
+                logger$c.getToken.info(formatError(scopes, error));
                 throw error;
             }
-            logger$d.getToken.info(formatSuccess(scopes));
+            logger$c.getToken.info(formatSuccess(scopes));
             return result;
         }
         catch (err) {
@@ -2273,14 +2378,14 @@ class ManagedIdentityCredential {
             // we can safely assume the credential is unavailable.
             if (err.code === "ENETUNREACH") {
                 const error = new CredentialUnavailableError(`${ManagedIdentityCredential.name}: Unavailable. Network unreachable. Message: ${err.message}`);
-                logger$d.getToken.info(formatError(scopes, error));
+                logger$c.getToken.info(formatError(scopes, error));
                 throw error;
             }
             // If either the host was unreachable,
             // we can safely assume the credential is unavailable.
             if (err.code === "EHOSTUNREACH") {
                 const error = new CredentialUnavailableError(`${ManagedIdentityCredential.name}: Unavailable. No managed identity endpoint found. Message: ${err.message}`);
-                logger$d.getToken.info(formatError(scopes, error));
+                logger$c.getToken.info(formatError(scopes, error));
                 throw error;
             }
             // If err.statusCode has a value of 400, it comes from sendTokenRequest,
@@ -2311,7 +2416,7 @@ class ManagedIdentityCredential {
      */
     handleResult(scopes, result, getTokenOptions) {
         this.ensureValidMsalToken(scopes, result, getTokenOptions);
-        logger$d.getToken.info(formatSuccess(scopes));
+        logger$c.getToken.info(formatSuccess(scopes));
         return {
             token: result.accessToken,
             expiresOnTimestamp: result.expiresOn.getTime(),
@@ -2323,7 +2428,7 @@ class ManagedIdentityCredential {
      */
     ensureValidMsalToken(scopes, msalToken, getTokenOptions) {
         const error = (message) => {
-            logger$d.getToken.info(message);
+            logger$c.getToken.info(message);
             return new AuthenticationRequiredError({
                 scopes: Array.isArray(scopes) ? scopes : [scopes],
                 getTokenOptions,
@@ -2419,7 +2524,7 @@ const cliCredentialInternals = {
         });
     },
 };
-const logger$c = credentialLogger("AzureCliCredential");
+const logger$b = credentialLogger("AzureCliCredential");
 /**
  * This credential will use the currently logged-in user login information
  * via the Azure CLI ('az') commandline tool.
@@ -2450,8 +2555,8 @@ class AzureCliCredential {
     async getToken(scopes, options = {}) {
         const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds);
         const scope = typeof scopes === "string" ? scopes : scopes[0];
-        logger$c.getToken.info(`Using the scope ${scope}`);
-        ensureValidScope(scope, logger$c);
+        logger$b.getToken.info(`Using the scope ${scope}`);
+        ensureValidScope(scope, logger$b);
         const resource = getScopeResource(scope);
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
             var _a, _b, _c, _d;
@@ -2462,18 +2567,18 @@ class AzureCliCredential {
                 const isNotInstallError = ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.match("az:(.*)not found")) || ((_d = obj.stderr) === null || _d === void 0 ? void 0 : _d.startsWith("'az' is not recognized"));
                 if (isNotInstallError) {
                     const error = new CredentialUnavailableError("Azure CLI could not be found. Please visit https://aka.ms/azure-cli for installation instructions and then, once installed, authenticate to your Azure account using 'az login'.");
-                    logger$c.getToken.info(formatError(scopes, error));
+                    logger$b.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 if (isLoginError) {
                     const error = new CredentialUnavailableError("Please run 'az login' from a command prompt to authenticate before using this credential.");
-                    logger$c.getToken.info(formatError(scopes, error));
+                    logger$b.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 try {
                     const responseData = obj.stdout;
                     const response = JSON.parse(responseData);
-                    logger$c.getToken.info(formatSuccess(scopes));
+                    logger$b.getToken.info(formatSuccess(scopes));
                     const returnValue = {
                         token: response.accessToken,
                         expiresOnTimestamp: new Date(response.expiresOn).getTime(),
@@ -2491,7 +2596,7 @@ class AzureCliCredential {
                 const error = err.name === "CredentialUnavailableError"
                     ? err
                     : new CredentialUnavailableError(err.message || "Unknown error while trying to retrieve the access token");
-                logger$c.getToken.info(formatError(scopes, error));
+                logger$b.getToken.info(formatError(scopes, error));
                 throw error;
             }
         });
@@ -2529,7 +2634,7 @@ const processUtils = {
 };
 
 // Copyright (c) Microsoft Corporation.
-const logger$b = credentialLogger("AzurePowerShellCredential");
+const logger$a = credentialLogger("AzurePowerShellCredential");
 const isWindows = process.platform === "win32";
 /**
  * Returns a platform-appropriate command name by appending ".exe" on Windows.
@@ -2661,12 +2766,12 @@ class AzurePowerShellCredential {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
             const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds);
             const scope = typeof scopes === "string" ? scopes : scopes[0];
-            ensureValidScope(scope, logger$b);
-            logger$b.getToken.info(`Using the scope ${scope}`);
+            ensureValidScope(scope, logger$a);
+            logger$a.getToken.info(`Using the scope ${scope}`);
             const resource = getScopeResource(scope);
             try {
                 const response = await this.getAzurePowerShellAccessToken(resource, tenantId);
-                logger$b.getToken.info(formatSuccess(scopes));
+                logger$a.getToken.info(formatSuccess(scopes));
                 return {
                     token: response.Token,
                     expiresOnTimestamp: new Date(response.ExpiresOn).getTime(),
@@ -2675,16 +2780,16 @@ class AzurePowerShellCredential {
             catch (err) {
                 if (isNotInstalledError(err)) {
                     const error = new CredentialUnavailableError(powerShellPublicErrorMessages.installed);
-                    logger$b.getToken.info(formatError(scope, error));
+                    logger$a.getToken.info(formatError(scope, error));
                     throw error;
                 }
                 else if (isLoginError(err)) {
                     const error = new CredentialUnavailableError(powerShellPublicErrorMessages.login);
-                    logger$b.getToken.info(formatError(scope, error));
+                    logger$a.getToken.info(formatError(scope, error));
                     throw error;
                 }
                 const error = new CredentialUnavailableError(`${err}. ${powerShellPublicErrorMessages.troubleshoot}`);
-                logger$b.getToken.info(formatError(scope, error));
+                logger$a.getToken.info(formatError(scope, error));
                 throw error;
             }
         });
@@ -2695,7 +2800,7 @@ class AzurePowerShellCredential {
 /**
  * @internal
  */
-const logger$a = credentialLogger("ChainedTokenCredential");
+const logger$9 = credentialLogger("ChainedTokenCredential");
 /**
  * Enables multiple `TokenCredential` implementations to be tried in order
  * until one of the getToken methods returns an access token.
@@ -2746,17 +2851,17 @@ class ChainedTokenCredential {
                         errors.push(err);
                     }
                     else {
-                        logger$a.getToken.info(formatError(scopes, err));
+                        logger$9.getToken.info(formatError(scopes, err));
                         throw err;
                     }
                 }
             }
             if (!token && errors.length > 0) {
                 const err = new AggregateAuthenticationError(errors, "ChainedTokenCredential authentication failed.");
-                logger$a.getToken.info(formatError(scopes, err));
+                logger$9.getToken.info(formatError(scopes, err));
                 throw err;
             }
-            logger$a.getToken.info(`Result for ${successfulCredentialName}: ${formatSuccess(scopes)}`);
+            logger$9.getToken.info(`Result for ${successfulCredentialName}: ${formatSuccess(scopes)}`);
             if (token === null) {
                 throw new CredentialUnavailableError("Failed to retrieve a valid token");
             }
@@ -2872,7 +2977,7 @@ class MsalClientCertificate extends MsalNode {
 
 // Copyright (c) Microsoft Corporation.
 const credentialName$2 = "ClientCertificateCredential";
-const logger$9 = credentialLogger(credentialName$2);
+const logger$8 = credentialLogger(credentialName$2);
 /**
  * Enables authentication to Azure Active Directory using a PEM-encoded
  * certificate that is assigned to an App Registration. More information
@@ -2903,7 +3008,7 @@ class ClientCertificateCredential {
             throw new Error(`${credentialName$2}: To avoid unexpected behaviors, providing both the contents of a PEM certificate and the path to a PEM certificate is forbidden. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.`);
         }
         this.msalFlow = new MsalClientCertificate(Object.assign(Object.assign({}, options), { configuration,
-            logger: logger$9,
+            logger: logger$8,
             clientId,
             tenantId, sendCertificateChain: options.sendCertificateChain, tokenCredentialOptions: options }));
     }
@@ -2955,7 +3060,7 @@ class MsalClientSecret extends MsalNode {
 }
 
 // Copyright (c) Microsoft Corporation.
-const logger$8 = credentialLogger("ClientSecretCredential");
+const logger$7 = credentialLogger("ClientSecretCredential");
 /**
  * Enables authentication to Azure Active Directory using a client secret
  * that was generated for an App Registration. More information on how
@@ -2981,7 +3086,7 @@ class ClientSecretCredential {
         }
         this.tenantId = tenantId;
         this.additionallyAllowedTenantIds = resolveAddionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
-        this.msalFlow = new MsalClientSecret(Object.assign(Object.assign({}, options), { logger: logger$8,
+        this.msalFlow = new MsalClientSecret(Object.assign(Object.assign({}, options), { logger: logger$7,
             clientId,
             tenantId,
             clientSecret, tokenCredentialOptions: options }));
@@ -3034,7 +3139,7 @@ class MsalUsernamePassword extends MsalNode {
 }
 
 // Copyright (c) Microsoft Corporation.
-const logger$7 = credentialLogger("UsernamePasswordCredential");
+const logger$6 = credentialLogger("UsernamePasswordCredential");
 /**
  * Enables authentication to Azure Active Directory with a user's
  * username and password. This credential requires a high degree of
@@ -3059,7 +3164,7 @@ class UsernamePasswordCredential {
         }
         this.tenantId = tenantId;
         this.additionallyAllowedTenantIds = resolveAddionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
-        this.msalFlow = new MsalUsernamePassword(Object.assign(Object.assign({}, options), { logger: logger$7,
+        this.msalFlow = new MsalUsernamePassword(Object.assign(Object.assign({}, options), { logger: logger$6,
             clientId,
             tenantId,
             username,
@@ -3110,7 +3215,7 @@ function getAdditionallyAllowedTenants() {
     return additionallyAllowedValues.split(";");
 }
 const credentialName$1 = "EnvironmentCredential";
-const logger$6 = credentialLogger(credentialName$1);
+const logger$5 = credentialLogger(credentialName$1);
 /**
  * Enables authentication to Azure Active Directory using a client secret or certificate, or as a user
  * with a username and password.
@@ -3144,29 +3249,29 @@ class EnvironmentCredential {
         // Keep track of any missing environment variables for error details
         this._credential = undefined;
         const assigned = processEnvVars(AllSupportedEnvironmentVariables).assigned.join(", ");
-        logger$6.info(`Found the following environment variables: ${assigned}`);
+        logger$5.info(`Found the following environment variables: ${assigned}`);
         const tenantId = process.env.AZURE_TENANT_ID, clientId = process.env.AZURE_CLIENT_ID, clientSecret = process.env.AZURE_CLIENT_SECRET;
         const additionallyAllowedTenantIds = getAdditionallyAllowedTenants();
         const newOptions = Object.assign(Object.assign({}, options), { additionallyAllowedTenantIds });
         if (tenantId) {
-            checkTenantId(logger$6, tenantId);
+            checkTenantId(logger$5, tenantId);
         }
         if (tenantId && clientId && clientSecret) {
-            logger$6.info(`Invoking ClientSecretCredential with tenant ID: ${tenantId}, clientId: ${clientId} and clientSecret: [REDACTED]`);
+            logger$5.info(`Invoking ClientSecretCredential with tenant ID: ${tenantId}, clientId: ${clientId} and clientSecret: [REDACTED]`);
             this._credential = new ClientSecretCredential(tenantId, clientId, clientSecret, newOptions);
             return;
         }
         const certificatePath = process.env.AZURE_CLIENT_CERTIFICATE_PATH;
         const certificatePassword = process.env.AZURE_CLIENT_CERTIFICATE_PASSWORD;
         if (tenantId && clientId && certificatePath) {
-            logger$6.info(`Invoking ClientCertificateCredential with tenant ID: ${tenantId}, clientId: ${clientId} and certificatePath: ${certificatePath}`);
+            logger$5.info(`Invoking ClientCertificateCredential with tenant ID: ${tenantId}, clientId: ${clientId} and certificatePath: ${certificatePath}`);
             this._credential = new ClientCertificateCredential(tenantId, clientId, { certificatePath, certificatePassword }, newOptions);
             return;
         }
         const username = process.env.AZURE_USERNAME;
         const password = process.env.AZURE_PASSWORD;
         if (tenantId && clientId && username && password) {
-            logger$6.info(`Invoking UsernamePasswordCredential with tenant ID: ${tenantId}, clientId: ${clientId} and username: ${username}`);
+            logger$5.info(`Invoking UsernamePasswordCredential with tenant ID: ${tenantId}, clientId: ${clientId} and username: ${username}`);
             this._credential = new UsernamePasswordCredential(tenantId, clientId, username, password, newOptions);
         }
     }
@@ -3181,7 +3286,7 @@ class EnvironmentCredential {
             if (this._credential) {
                 try {
                     const result = await this._credential.getToken(scopes, newOptions);
-                    logger$6.getToken.info(formatSuccess(scopes));
+                    logger$5.getToken.info(formatSuccess(scopes));
                     return result;
                 }
                 catch (err) {
@@ -3189,7 +3294,7 @@ class EnvironmentCredential {
                         error: `${credentialName$1} authentication failed. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`,
                         error_description: err.message.toString().split("More details:").join(""),
                     });
-                    logger$6.getToken.info(formatError(scopes, authenticationError));
+                    logger$5.getToken.info(formatError(scopes, authenticationError));
                     throw authenticationError;
                 }
             }
@@ -3247,7 +3352,7 @@ const developerCliCredentialInternals = {
         });
     },
 };
-const logger$5 = credentialLogger("AzureDeveloperCliCredential");
+const logger$4 = credentialLogger("AzureDeveloperCliCredential");
 /**
  * This credential will use the currently logged-in user login information
  * via the Azure Developer CLI ('az') commandline tool.
@@ -3284,7 +3389,7 @@ class AzureDeveloperCliCredential {
         else {
             scopeList = scopes;
         }
-        logger$5.getToken.info(`Using the scopes ${scopes}`);
+        logger$4.getToken.info(`Using the scopes ${scopes}`);
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
             var _a, _b, _c;
             try {
@@ -3294,17 +3399,17 @@ class AzureDeveloperCliCredential {
                     ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.startsWith("'azd' is not recognized"));
                 if (isNotInstallError || (obj.error && obj.error.code === "ENOENT")) {
                     const error = new CredentialUnavailableError("Azure Developer CLI could not be found. Please visit https://aka.ms/azure-dev for installation instructions and then, once installed, authenticate to your Azure account using 'azd login'.");
-                    logger$5.getToken.info(formatError(scopes, error));
+                    logger$4.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 if (isNotLoggedInError) {
                     const error = new CredentialUnavailableError("Please run 'azd login' from a command prompt to authenticate before using this credential.");
-                    logger$5.getToken.info(formatError(scopes, error));
+                    logger$4.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 try {
                     const resp = JSON.parse(obj.stdout);
-                    logger$5.getToken.info(formatSuccess(scopes));
+                    logger$4.getToken.info(formatSuccess(scopes));
                     return {
                         token: resp.token,
                         expiresOnTimestamp: new Date(resp.expiresOn).getTime(),
@@ -3321,7 +3426,7 @@ class AzureDeveloperCliCredential {
                 const error = err.name === "CredentialUnavailableError"
                     ? err
                     : new CredentialUnavailableError(err.message || "Unknown error while trying to retrieve the access token");
-                logger$5.getToken.info(formatError(scopes, error));
+                logger$4.getToken.info(formatError(scopes, error));
                 throw error;
             }
         });
@@ -3342,11 +3447,16 @@ class DefaultManagedIdentityCredential extends ManagedIdentityCredential {
         var _a;
         const managedIdentityClientId = (_a = options === null || options === void 0 ? void 0 : options.managedIdentityClientId) !== null && _a !== void 0 ? _a : process.env.AZURE_CLIENT_ID;
         const managedResourceId = options === null || options === void 0 ? void 0 : options.managedIdentityResourceId;
+        const workloadFile = process.env.AZURE_FEDERATED_TOKEN_FILE;
         // ManagedIdentityCredential throws if both the resourceId and the clientId are provided.
         if (managedResourceId) {
             const managedIdentityResourceIdOptions = Object.assign(Object.assign({}, options), { resourceId: managedResourceId });
             super(managedIdentityResourceIdOptions);
         }
+        else if (workloadFile) {
+            const workloadIdentityCredentialOptions = Object.assign(Object.assign({}, options), { clientId: managedIdentityClientId, federatedTokenFilePath: workloadFile });
+            super(workloadIdentityCredentialOptions);
+        }
         else if (managedIdentityClientId) {
             const managedIdentityClientOptions = Object.assign(Object.assign({}, options), { clientId: managedIdentityClientId });
             super(managedIdentityClientOptions);
@@ -3358,6 +3468,7 @@ class DefaultManagedIdentityCredential extends ManagedIdentityCredential {
 }
 const defaultCredentials = [
     EnvironmentCredential,
+    WorkloadIdentityCredential,
     DefaultManagedIdentityCredential,
     AzureDeveloperCliCredential,
     AzureCliCredential,
@@ -3373,88 +3484,6 @@ class DefaultAzureCredential extends ChainedTokenCredential {
     }
 }
 
-// Copyright (c) Microsoft Corporation.
-/**
- * MSAL client assertion client. Calls to MSAL's confidential application's `acquireTokenByClientCredential` during `doGetToken`.
- * @internal
- */
-class MsalClientAssertion extends MsalNode {
-    constructor(options) {
-        super(options);
-        this.requiresConfidential = true;
-        this.getAssertion = options.getAssertion;
-    }
-    async doGetToken(scopes, options = {}) {
-        try {
-            const assertion = await this.getAssertion();
-            const result = await this.confidentialApp.acquireTokenByClientCredential({
-                scopes,
-                correlationId: options.correlationId,
-                azureRegion: this.azureRegion,
-                authority: options.authority,
-                claims: options.claims,
-                clientAssertion: assertion,
-            });
-            // The Client Credential flow does not return an account,
-            // so each time getToken gets called, we will have to acquire a new token through the service.
-            return this.handleResult(scopes, this.clientId, result || undefined);
-        }
-        catch (err) {
-            let err2 = err;
-            if (err === null || err === undefined) {
-                err2 = new Error(JSON.stringify(err));
-            }
-            else {
-                err2 = coreUtil.isError(err) ? err : new Error(String(err));
-            }
-            throw this.handleError(scopes, err2, options);
-        }
-    }
-}
-
-// Copyright (c) Microsoft Corporation.
-const logger$4 = credentialLogger("ClientAssertionCredential");
-/**
- * Authenticates a service principal with a JWT assertion.
- */
-class ClientAssertionCredential {
-    /**
-     * Creates an instance of the ClientAssertionCredential with the details
-     * needed to authenticate against Azure Active Directory with a client
-     * assertion provided by the developer through the `getAssertion` function parameter.
-     *
-     * @param tenantId - The Azure Active Directory tenant (directory) ID.
-     * @param clientId - The client (application) ID of an App Registration in the tenant.
-     * @param getAssertion - A function that retrieves the assertion for the credential to use.
-     * @param options - Options for configuring the client which makes the authentication request.
-     */
-    constructor(tenantId, clientId, getAssertion, options = {}) {
-        if (!tenantId || !clientId || !getAssertion) {
-            throw new Error("ClientAssertionCredential: tenantId, clientId, and clientAssertion are required parameters.");
-        }
-        this.tenantId = tenantId;
-        this.additionallyAllowedTenantIds = resolveAddionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
-        this.clientId = clientId;
-        this.options = options;
-        this.msalFlow = new MsalClientAssertion(Object.assign(Object.assign({}, options), { logger: logger$4, clientId: this.clientId, tenantId: this.tenantId, tokenCredentialOptions: this.options, getAssertion }));
-    }
-    /**
-     * Authenticates with Azure Active Directory and returns an access token if successful.
-     * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
-     *
-     * @param scopes - The list of scopes for which the token will have access.
-     * @param options - The options used to configure any requests this
-     *                TokenCredential implementation might make.
-     */
-    async getToken(scopes, options = {}) {
-        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
-            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds);
-            const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
-            return this.msalFlow.getToken(arrayScopes, newOptions);
-        });
-    }
-}
-
 // Copyright (c) Microsoft Corporation.
 /**
  * A call to open(), but mockable
@@ -4009,6 +4038,7 @@ exports.ManagedIdentityCredential = ManagedIdentityCredential;
 exports.OnBehalfOfCredential = OnBehalfOfCredential;
 exports.UsernamePasswordCredential = UsernamePasswordCredential;
 exports.VisualStudioCodeCredential = VisualStudioCodeCredential;
+exports.WorkloadIdentityCredential = WorkloadIdentityCredential;
 exports.deserializeAuthenticationRecord = deserializeAuthenticationRecord;
 exports.getDefaultAzureCredential = getDefaultAzureCredential;
 exports.logger = logger$m;