Constructor EntraCredentialDeclaration

Namespace

MailFathom.AI.Embeddings

Assembly

MailFathom.AI.dll

EntraCredentialDeclaration(EmbeddingEndpointCredentialKind, string, string?, string?, string?, string?, string?)

Everything one non-interactive Microsoft Entra credential is built from.

public EntraCredentialDeclaration(EmbeddingEndpointCredentialKind Kind, string TokenScope, string? TenantId, string? ClientId, string? ClientSecret, string? CertificatePath, string? CertificatePassword)

Parameters

Kind EmbeddingEndpointCredentialKind

Which of the four non-interactive shapes the deployment holds.

TokenScope string

The scope an access token is requested for.

TenantId string

The directory the application is registered in, or null where the shape reads it from the platform.

ClientId string

The application or user-assigned identity being authenticated, or null for a system-assigned managed identity.

ClientSecret string

The resolved application secret, for ClientSecret alone.

CertificatePath string

The path of the application certificate, for ClientCertificate alone.

CertificatePassword string

The resolved password protecting that certificate, or null where it needs none.

Remarks

A record of resolved values rather than of references, because resolving a reference is the host's business and this boundary holds no secret provider. What arrives here is what a credential is constructed with and nothing more.

The scope is declared rather than derived, because it is the audience an access token is minted for and the value has changed as the service was renamed. Deriving it from an endpoint address would silently mint tokens for the wrong audience the next time it moves, which arrives as an authentication failure with no configuration to point at.