{"record":{"id":"2a97b8baa1c48e54","repo":"hashicorp/terraform","slug":"mismatch-between-supplied-client-id-and-that-provi","errorCode":null,"errorMessage":"mismatch between supplied Client ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity","messagePattern":"mismatch between supplied Client ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/helpers.go","lineNumber":105,"sourceCode":"\t\tfileClientIdRaw, err := os.ReadFile(path)\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading Client ID from file %q: %v\", path, err)\n\t\t}\n\n\t\tfileClientId := strings.TrimSpace(string(fileClientIdRaw))\n\n\t\tif clientId != \"\" && clientId != fileClientId {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Client ID and supplied Client ID file contents - please either remove one or ensure they match\")\n\t\t}\n\n\t\tclientId = fileClientId\n\t}\n\n\tif d.Bool(\"use_aks_workload_identity\") && os.Getenv(\"AZURE_CLIENT_ID\") != \"\" {\n\t\taksClientId := os.Getenv(\"AZURE_CLIENT_ID\")\n\t\tif clientId != \"\" && clientId != aksClientId {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Client ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity\")\n\t\t}\n\t\tclientId = aksClientId\n\t}\n\n\treturn &clientId, nil\n}\n\nfunc getClientSecret(d *backendbase.SDKLikeData) (*string, error) {\n\tclientSecret := strings.TrimSpace(d.String(\"client_secret\"))\n\n\tif path := d.String(\"client_secret_file_path\"); path != \"\" {\n\t\tfileSecretRaw, err := os.ReadFile(path)\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading Client Secret from file %q: %v\", path, err)\n\t\t}\n\n\t\tfileSecret := strings.TrimSpace(string(fileSecretRaw))","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/helpers.go#L87-L123","documentation":"In the AKS-workload-identity branch of getClientId (helpers.go:105), if a client_id was already resolved and differs from the `AZURE_CLIENT_ID` env var injected by the workload-identity webhook, the backend aborts rather than silently switching identity.","triggerScenarios":"use_aks_workload_identity=true, AZURE_CLIENT_ID is set, and an inline client_id / client_id_file_path value that does not match is also configured.","commonSituations":"Left-over client_id from a previous non-AKS setup; pointing at a different app registration than the federated credential is bound to; mismatched annotation and backend config.","solutions":["Remove client_id / client_id_file_path when using AKS workload identity and let AZURE_CLIENT_ID be authoritative.","Ensure the configured client_id equals the app registration the federated credential targets.","Disable use_aks_workload_identity if you want the inline client_id to win."],"exampleFix":"# before\nbackend \"azurerm\" {\n  use_aks_workload_identity = true\n  client_id                 = \"22222222-2222-2222-2222-222222222222\"\n}\n# after\nbackend \"azurerm\" {\n  use_aks_workload_identity = true\n}","handlingStrategy":"validation","validationCode":"# ensure no conflicting client_id when AKS workload identity is used\nif [ \"${TF_VAR_use_aks_workload_identity:-false}\" = \"true\" ] && [ -n \"${AZURE_CLIENT_ID:-}\" ]; then\n  [ -z \"${TF_VAR_client_id:-}\" ] || [ \"$TF_VAR_client_id\" = \"$AZURE_CLIENT_ID\" ] \\\n    || { echo \"client_id conflicts with AZURE_CLIENT_ID\" >&2; exit 1; }\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not set client_id when using AKS workload identity.","Align the federated-credential app registration with the backend config."],"tags":["azure","client-id","aks","workload-identity","config"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}