[vcolin7]

Description

AKS identity binding mode already exists in the 1.19.0-beta.x line, but its proxy handling could retain configuration across builds, miss the configured TLS name, or hide response I/O failures. This PR hardens that path and updates the package version references for 1.19.0, without enabling identity binding mode in DefaultAzureCredential or ManagedIdentityCredential.

• Validate proxy configuration and clone options per credential so reusing a builder does not retain the previous proxy transport.
• Verify the configured TLS name before sending assertions, including single-label DNS wildcard certificates. Reject partially malformed CA bundles, synchronize TLS context/socket-factory replacement, and retain a previously loaded CA during missing-file rotation windows while preserving the existing empty-file fallback.
• Offload blocking operations in the internal reactive transport/body APIs and propagate response-read failures instead of returning an empty body. Preserve HTTP error bodies and status codes. The MSAL bridge's synchronous send path is unchanged.
• Expand local HTTPS coverage for routing, CA changes, caching, concurrency, retries, wildcard matching, and error handling, with updated JavaDoc, usage guidance, and a compiled example.
• Restore the normal released Core/Netty dependency references for the stable package and keep the HTTPS test fixture compatible with Netty 4.1.

Compatibility: enableAzureProxy() remains opt-in. A supplied HttpPipeline retains Azure Core's normal precedence, and this PR does not add a rejection of custom pipelines or legacy proxyOptions.

This change does not regenerate an SDK from Swagger or TypeSpec.

Background: AKS identity binding guide and Azure/azure-sdk-for-net#63944.

Validation

Real AKS live run

The gist's enabled/disabled matrix passed on October 22, 2026, using the locally built azure-identity 1.19.0 candidate from commit f8dca06fa9f670d6421cfd78dd19b415c653efec, running on Java 25 in AKS.

1. Provisioned an isolated AKS cluster with OIDC and workload identity enabled, a dedicated user-assigned managed identity, and an identity binding. Verified that the identity had exactly one AKS-managed federated credential, no conventional service-account federated credential, and no Azure resource-access roles.
2. Uploaded the built Identity JAR, its runtime dependencies, and a temporary Java probe directly into separate enabled/disabled Kubernetes Jobs with fresh JVMs. Each Job verified the Identity JAR version and SHA-256 before constructing a credential.
3. Validated the webhook-injected tenant/client IDs, projected service-account token, proxy endpoint, SNI name, and exactly one CA source (AZURE_KUBERNETES_CA_FILE). All successful tokens were checked for the expected tenant and managed-identity client ID, a future AccessToken.getExpiresAt(), and an unexpired JWT exp.

Scenario	Final live result
Async acquisition	Valid token; 2 proxy responses
Repeated acquisition on the same credential	Same token; zero additional HTTP requests
Fresh synchronous credential	Valid token; 1 additional proxy response
Four concurrent acquisitions on a fresh credential	All four succeeded; 5 additional proxy responses
ARM GET against the dedicated test resource group	Expected 403 AuthorizationFailed, confirming token acceptance without resource-access permission
Proxy disabled in a separate Job	Expected AADSTS700211; 2 direct responses and zero proxy responses

Routing counts came from a pipeline policy examining the transport-adjusted request URL returned with each response, not the original Entra URL or a packet capture.

Live coverage used CA-file trust; live CA rotation and fault injection were not performed.

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

Written with the help or Copilot

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
35 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The additional TLS name check rejects valid wildcard certificates, breaking previously successful proxy authentication.

1 open issue

• Accept valid wildcard certificates in custom hostname verification · New

What changed in this PR

This PR hardens the opt-in AKS identity binding transport in Azure Identity without enabling it in DefaultAzureCredential or ManagedIdentityCredential.

Changes:

• Isolates per-credential proxy configuration and rejects incompatible transport options.
• Strengthens TLS verification, CA rotation handling, and asynchronous response processing.
• Expands local HTTPS tests, troubleshooting guidance, and compiled usage examples.

File	Description
sdk/​identity/​azure-identity/​TROUBLESHOOTING.md	Documents proxy configuration and TLS failures.
sdk/​identity/​azure-identity/​src/​test/​java/​com/​azure/​identity/​WorkloadIdentityCredentialTest.java	Tests builder isolation and opt-in restrictions.
sdk/​identity/​azure-identity/​src/​test/​java/​com/​azure/​identity/​WorkloadIdentityCredentialIdentityBindingTest.java	Expands HTTPS routing, rotation, retry, and authentication coverage.
sdk/​identity/​azure-identity/​src/​test/​java/​com/​azure/​identity/​implementation/​customtokenproxy/​CustomTokenProxyHttpResponseTest.java	Tests body caching, scheduling, and error preservation.
sdk/​identity/​azure-identity/​src/​test/​java/​com/​azure/​identity/​implementation/​customtokenproxy/​CustomTokenProxyHttpClientTest.java	Tests lazy asynchronous sends and context forwarding.
sdk/​identity/​azure-identity/​src/​test/​java/​com/​azure/​identity/​implementation/​customtokenproxy/​CustomTokenProxyConfigurationTest.java	Tests proxy URL and CA configuration validation.
sdk/​identity/​azure-identity/​src/​samples/​java/​com/​azure/​identity/​credential/​JavaDocCodeSnippets.java	Adds an identity binding construction example.
sdk/​identity/​azure-identity/​src/​main/​java/​com/​azure/​identity/​WorkloadIdentityCredentialBuilder.java	Clones transport options and rejects incompatible settings.
sdk/​identity/​azure-identity/​src/​main/​java/​com/​azure/​identity/​WorkloadIdentityCredential.java	Clarifies workload identity and binding JavaDoc.
sdk/​identity/​azure-identity/​src/​main/​java/​com/​azure/​identity/​implementation/​customtokenproxy/​CustomTokenProxyHttpResponse.java	Offloads body reads and propagates I/O failures.
sdk/​identity/​azure-identity/​src/​main/​java/​com/​azure/​identity/​implementation/​customtokenproxy/​CustomTokenProxyHttpClient.java	Hardens TLS checks, CA reloads, and connection handling.
sdk/​identity/​azure-identity/​src/​main/​java/​com/​azure/​identity/​implementation/​customtokenproxy/​CustomTokenProxyConfiguration.java	Tightens proxy URL and CA validation.
sdk/​identity/​azure-identity/​README.md	Adds setup requirements and opt-in usage guidance.
sdk/​identity/​azure-identity/​CHANGELOG.md	Records proxy hardening and preview compatibility changes.

_{Review effort: Balanced}