{"record":{"id":"9eb01b65b5ebca6a","repo":"hashicorp/terraform","slug":"mismatch-between-supplied-client-id-and-supplied-c","errorCode":null,"errorMessage":"mismatch between supplied Client ID and supplied Client ID file contents - please either remove one or ensure they match","messagePattern":"mismatch between supplied Client ID and supplied Client ID file contents - please either remove one or ensure they match","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/helpers.go","lineNumber":96,"sourceCode":"\t}\n\n\treturn &idToken, nil\n}\n\nfunc getClientId(d *backendbase.SDKLikeData) (*string, error) {\n\tclientId := strings.TrimSpace(d.String(\"client_id\"))\n\n\tif path := d.String(\"client_id_file_path\"); path != \"\" {\n\t\tfileClientIdRaw, err := os.ReadFile(path)\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading Client ID from file %q: %v\", path, err)\n\t\t}\n\n\t\tfileClientId := strings.TrimSpace(string(fileClientIdRaw))\n\n\t\tif clientId != \"\" && clientId != fileClientId {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Client ID and supplied Client ID file contents - please either remove one or ensure they match\")\n\t\t}\n\n\t\tclientId = fileClientId\n\t}\n\n\tif d.Bool(\"use_aks_workload_identity\") && os.Getenv(\"AZURE_CLIENT_ID\") != \"\" {\n\t\taksClientId := os.Getenv(\"AZURE_CLIENT_ID\")\n\t\tif clientId != \"\" && clientId != aksClientId {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Client ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity\")\n\t\t}\n\t\tclientId = aksClientId\n\t}\n\n\treturn &clientId, nil\n}\n\nfunc getClientSecret(d *backendbase.SDKLikeData) (*string, error) {\n\tclientSecret := strings.TrimSpace(d.String(\"client_secret\"))","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/helpers.go#L78-L114","documentation":"getClientId (helpers.go:96) rejects the configuration when both `client_id` and `client_id_file_path` are supplied and the two values differ after trimming. The backend will not guess which ID to use.","triggerScenarios":"Setting client_id inline and client_id_file_path simultaneously in the backend block (or env) with non-identical values.","commonSituations":"Rotating the app registration but updating only the inline value; copy-paste of a wrong GUID; env var left over from a different tenant.","solutions":["Provide only one of client_id or client_id_file_path.","If both must remain, make the inline value exactly equal to the file contents (after trimming).","Re-export the correct client ID into the single source you keep."],"exampleFix":"# before\nbackend \"azurerm\" {\n  client_id           = \"11111111-1111-1111-1111-111111111111\"\n  client_id_file_path = \"/etc/azure/client-id\"   # holds a different GUID\n}\n# after\nbackend \"azurerm\" {\n  client_id_file_path = \"/etc/azure/client-id\"\n}","handlingStrategy":"validation","validationCode":"# ensure client_id and client_id_file_path agree, or only one is set\ncid=\"${TF_VAR_client_id:-}\"\nfile=\"${TF_VAR_client_id_file_path:-}\"\nif [ -n \"$cid\" ] && [ -n \"$file\" ]; then\n  fc=\"$(tr -d '[:space:]' < \"$file\")\"\n  [ \"$cid\" = \"$fc\" ] || { echo \"client id / file mismatch\" >&2; exit 1; }\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provide only one client-id source.","Update all sources together when rotating app registrations."],"tags":["azure","client-id","config","authentication"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}