{"record":{"id":"87044e3786690237","repo":"hashicorp/terraform","slug":"mismatch-between-supplied-oidc-token-and-supplied","errorCode":null,"errorMessage":"mismatch between supplied OIDC token and supplied OIDC token file contents - please either remove one or ensure they match","messagePattern":"mismatch between supplied OIDC token and supplied OIDC token file contents - please either remove one or ensure they match","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/helpers.go","lineNumber":57,"sourceCode":"\t\tpfx = out[:n]\n\t}\n\treturn pfx, nil\n}\n\nfunc getOidcToken(d *backendbase.SDKLikeData) (*string, error) {\n\tidToken := strings.TrimSpace(d.String(\"oidc_token\"))\n\n\tif path := d.String(\"oidc_token_file_path\"); path != \"\" {\n\t\tfileTokenRaw, err := os.ReadFile(path)\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading OIDC Token from file %q: %v\", path, err)\n\t\t}\n\n\t\tfileToken := strings.TrimSpace(string(fileTokenRaw))\n\n\t\tif idToken != \"\" && idToken != fileToken {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied OIDC token and supplied OIDC token file contents - please either remove one or ensure they match\")\n\t\t}\n\n\t\tidToken = fileToken\n\t}\n\n\tif d.Bool(\"use_aks_workload_identity\") && os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\") != \"\" {\n\t\tpath := os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\")\n\t\tfileTokenRaw, err := os.ReadFile(os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\"))\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading OIDC Token from file %q provided by AKS Workload Identity: %v\", path, err)\n\t\t}\n\n\t\tfileToken := strings.TrimSpace(string(fileTokenRaw))\n\n\t\tif idToken != \"\" && idToken != fileToken {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied OIDC token and OIDC token file contents provided by AKS Workload Identity - please either remove one, ensure they match, or disable use_aks_workload_identity\")\n\t\t}","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/helpers.go#L39-L75","documentation":"getOidcToken (helpers.go:57) detects that both `oidc_token` (inline) and `oidc_token_file_path` (file) were supplied and, after trimming whitespace, the two resolved token values differ. The backend refuses to guess which credential to use, so a divergence is treated as a hard misconfiguration.","triggerScenarios":"Setting both oidc_token and oidc_token_file_path in the backend block (or via the corresponding env vars) such that the inline token and the file's contents are not byte-equal after trimming.","commonSituations":"Token rotation where only one of the two sources was updated; a leftover oidc_token env var while the file path was changed; copy-paste drift between the two sources.","solutions":["Provide only ONE of oidc_token or oidc_token_file_path and remove the other.","If both must remain, make the inline value byte-identical (after trimming whitespace) to the file contents.","Re-export the correct token into whichever single source you intend to keep."],"exampleFix":"# before\nterraform {\n  backend \"azurerm\" {\n    oidc_token           = \"eyJhbGci...OLD\"\n    oidc_token_file_path = \"/etc/tf/token\"   # contains NEW token\n  }\n}\n# after\nterraform {\n  backend \"azurerm\" {\n    oidc_token_file_path = \"/etc/tf/token\"\n  }\n}","handlingStrategy":"validation","validationCode":"# ensure inline oidc_token matches the file, or only one is set\ntok=\"${TF_VAR_oidc_token:-}\"\nfile=\"${TF_VAR_oidc_token_file_path:-}\"\nif [ -n \"$tok\" ] && [ -n \"$file\" ]; then\n  ft=\"$(tr -d '[:space:]' < \"$file\")\"\n  t=\"$(printf '%s' \"$tok\" | tr -d '[:space:]')\"\n  [ \"$t\" = \"$ft\" ] || { echo \"oidc token / file mismatch\" >&2; exit 1; }\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provide only one OIDC credential source.","When rotating tokens, update all sources together.","Lint backend blocks to flag conflicting auth keys."],"tags":["azure","oidc","config","authentication"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}