{"record":{"id":"7c7a1bac24132d2f","repo":"oauth2-proxy/oauth2-proxy","slug":"error-reading-federated-token-file-s-s","errorCode":null,"errorMessage":"error reading federated token file %s: %s","messagePattern":"error reading federated token file (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"providers/ms_entra_id.go","lineNumber":117,"sourceCode":"\treturn p.OIDCProvider.ValidateSession(ctx, session)\n}\n\n// Redeem exchanges the OAuth2 authentication token for an ID token, considering federated token authentication\nfunc (p *MicrosoftEntraIDProvider) Redeem(ctx context.Context, redirectURL, code, codeVerifier string) (*sessions.SessionState, error) {\n\tif p.federatedTokenAuth {\n\t\treturn p.redeemWithFederatedToken(ctx, redirectURL, code, codeVerifier)\n\t}\n\n\treturn p.OIDCProvider.Redeem(ctx, redirectURL, code, codeVerifier)\n}\n\n// redeemWithFederatedToken performs custom token exchange with federated token instead of client secret\nfunc (p *MicrosoftEntraIDProvider) redeemWithFederatedToken(ctx context.Context, redirectURL, code, codeVerifier string) (*sessions.SessionState, error) {\n\tfederatedTokenPath := os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\")\n\t// #nosec G703 -- AZURE_FEDERATED_TOKEN_FILE is set by the operator, not user input\n\tfederatedToken, err := os.ReadFile(federatedTokenPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error reading federated token file %s: %s\", federatedTokenPath, err)\n\t}\n\n\tparams := url.Values{}\n\n\t// Exchange parameters for token federation\n\t// https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-access-token-with-a-certificate-credential\n\tif codeVerifier != \"\" {\n\t\tparams.Add(\"code_verifier\", codeVerifier)\n\t}\n\tparams.Add(\"redirect_uri\", redirectURL)\n\tparams.Add(\"client_id\", p.ClientID)\n\tparams.Add(\"client_assertion\", string(federatedToken))\n\tparams.Add(\"client_assertion_type\", \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\")\n\tparams.Add(\"code\", code)\n\tparams.Add(\"grant_type\", \"authorization_code\")\n\n\ttoken, err := p.fetchToken(ctx, params)\n\tif err != nil {","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/oauth2-proxy/oauth2-proxy/blob/33c2eb92dea78204f7a18bc2dfdbccc220f39257/providers/ms_entra_id.go#L99-L135","documentation":"redeemWithFederatedToken performs Entra client-assertion authentication using workload identity federation: it reads the federated credential JWT from the path in the AZURE_FEDERATED_TOKEN_FILE environment variable. If the file cannot be read (missing, unreadable, wrong path), Redeem fails with this wrapped error naming the path and OS error.","triggerScenarios":"Redeem -> redeemWithFederatedToken (federated-token mode enabled) with AZURE_FEDERATED_TOKEN_FILE unset (path empty) or pointing to a nonexistent/unreadable file, so os.ReadFile returns an error.","commonSituations":"Running outside Azure Kubernetes Service where the projected service-account token file doesn't exist; env var forgotten in the deployment manifest; file not yet mounted at container start; permissions changed on the mounted token path.","solutions":["Set AZURE_FEDERATED_TOKEN_FILE to the projected service-account token path (in AKS: /var/run/secrets/azure/tokens/azure-identity-token).","Confirm the volume/CSI driver mounting the federated token is configured and the file exists: 'ls -l $AZURE_FEDERATED_TOKEN_FILE'.","Check file permissions so the process user can read the token file.","If not using workload identity federation, disable the federated-token mode so Redeem uses the client secret path instead."],"exampleFix":"// before\n# deployment yaml: env AZURE_FEDERATED_TOKEN_FILE not set\n// after\nenv:\n  - name: AZURE_FEDERATED_TOKEN_FILE\n    value: /var/run/secrets/azure/tokens/azure-identity-token","handlingStrategy":"validation","validationCode":"tokenPath := os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\")\nif tokenPath == \"\" { return errors.New(\"AZURE_FEDERATED_TOKEN_FILE must be set for federated token exchange\") }\nif _, err := os.Stat(tokenPath); err != nil {\n    return fmt.Errorf(\"federated token file %s not readable: %w\", tokenPath, err)\n}","typeGuard":null,"tryCatchPattern":"s, err := provider.Redeem(ctx, redirectURL, code)\nif err != nil && strings.Contains(err.Error(), \"error reading federated token file\") {\n    log.Fatalf(\"federated credential misconfigured: %v\", err)\n}","preventionTips":["Mount the AKS workload-identity token volume in every deployment using federated auth.","Fail fast at startup with a stat check on AZURE_FEDERATED_TOKEN_FILE rather than at first Redeem.","Keep a startup healthcheck that reads the token file and logs its expiry."],"tags":["entra-id","azure","federated-identity","workload-identity","file"],"backgroundTag":"file-read-failed","analyzedSha":"33c2eb92dea78204f7a18bc2dfdbccc220f39257","analyzedAt":"2026-09-06T08:51:53.077Z","contentChangedAt":"2026-09-06T08:51:53.077Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}