Enable Workload Identity for Azure AD and Microsoft Connector

[avo-sepp]

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Problem Description

The Microsoft connector is limited to using a Client ID and Client Secret for authentication with an Azure App Registration. It is possible to use Workload Identity Federation on Dex when installed in Kubernetes.

Client Secrets often have short lifespans and this can be a problem for system administrators to rotate regularly.

Proposed Solution

Allow the Microsoft Connector login via Microsoft Workload Identity Federation. If the end-user configures a Service Account and Federation correctly, Kubernetes will inject an environment variable named AZURE_FEDERATED_TOKEN_FILE. The path in the environment variable will lead to a file with an auth token that Dex should use to Auth. That token should be used to Authenticate as the client in Azure.

Alternatives Considered

No response

Additional Information

No response