Enhanced Vault guides and fixed some wording.

docs/vault-entra-id.md

@@ -102,9 +102,10 @@ Role: **User**
     export VAULT_CACERT=/path/to/server-ca.pem
     ```
 
-2. Log in with the Entra ID account. The CLI starts a listener on `localhost:8250` and opens the browser with the Entra ID sign-in page. After the sign-in the CLI stores the token in the token helper file (`~/.vault-token`).
+2. Unset `VAULT_TOKEN`, because a token in this environment variable takes precedence over the token stored by `vault login` and the CLI would keep using it. Then log in with the Entra ID account. The CLI starts a listener on `localhost:8250` and opens the browser with the Entra ID sign-in page. After the sign-in the CLI stores the token in the token helper file (`~/.vault-token`).
 
     ```bash
+    unset VAULT_TOKEN
     vault login -method=oidc role=entra-pki
     ```
 
@@ -141,3 +142,21 @@ Role: **User**
     ```
 
 The user token can only sign with the `wif-client` role. Reading the role or any other path returns `permission denied`.
+
+## Next steps
+
+1. Create the credentials configuration `cred.json` for `client_cert.pem` and `client_key.pem`. The names come from `env.sh`.
+
+    ```bash
+    gcloud iam workload-identity-pools create-cred-config \
+        "projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}/providers/${PROVIDER_ID}" \
+        --service-account="${SA_EMAIL}" \
+        --credential-cert-path=client_cert.pem \
+        --credential-cert-private-key-path=client_key.pem \
+        --output-file=cred.json
+    ```
+
+2. Activate the service account with `gcloud auth login --cred-file=cred.json`.
+3. Run the WIF tests.
+
+Example test commands are in `test_wif.sh`.