[Identity] Enable identity binding mode for WorkloadIdentityCredential in AKS

[JonathanCrd]

Fixes https://github.com/Azure/azure-sdk-for-net-pr/issues/2050

This PR adds opt-in Kubernetes token proxy support to WorkloadIdentityCredential to work around Entra ID's limit on federated identity credentials (FICs) per managed identity. When enabled, the credential redirects all token requests to an AKS-provided proxy that handles the FIC exchange centrally.

Changes

New API

• Added AzureKubernetesTokenProxy property to WorkloadIdentityCredentialOptions (opt-in, default: false)

Environment Variables

When AzureKubernetesTokenProxy = true, the credential reads:

Variable	Description
AZURE_KUBERNETES_TOKEN_PROXY	Base HTTPS URL for the proxy endpoint (required)
AZURE_KUBERNETES_CA_FILE	Path to PEM bundle with proxy CA certificates
AZURE_KUBERNETES_CA_DATA	PEM-encoded CA bundle (mutually exclusive with CA_FILE)
AZURE_KUBERNETES_SNI_NAME	TLS Server Name Indication (optional)

Key Behaviors

• Opt-in only: Disabled by default, requires explicit AzureKubernetesTokenProxy = true
• Fail-fast validation: Invalid/incomplete configuration throws InvalidOperationException at construction
• Certificate rotation: Automatically monitors CA_FILE for changes and updates TLS configuration
• netstandard2.0 compatible: Custom PEM parsing and certificate validation for legacy framework support

Implementation

Uses DelegatingHandler to intercept HTTP requests and redirect them to the proxy endpoint while preserving paths and query parameters. Implements custom certificate handling for netstandard2.0 compatibility.

Testing

• ✅ 10 unit tests (configuration validation, URL parsing, error handling)
• ⚠️ 3 live tests (CA file/data, SNI scenarios - require AKS environment) STILL PENDING TO TEST AGAINST AKS
• ✅ All frameworks: net8.0, net9.0, net462, netstandard2.0

Example

var credential = new WorkloadIdentityCredential(new WorkloadIdentityCredentialOptions
{
    AzureKubernetesTokenProxy = true  // Enable proxy mode
});

var token = await credential.GetTokenAsync(
    new TokenRequestContext(new[] { "https://management.azure.com/.default" }));

[github-actions]

API Change Check

APIView identified API level changes in this PR and created the following API reviews

Azure.Identity