{"record":{"id":"abd5fe3903fa2d08","repo":"git-ecosystem/git-credential-manager","slug":"unsupported-workload-federation-scenario","errorCode":null,"errorMessage":"Unsupported workload federation scenario.","messagePattern":"Unsupported workload federation scenario\\.","errorType":"exception","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"src/Core/Authentication/Entra/EntraAuthentication.ConfidentialClient.cs","lineNumber":111,"sourceCode":"                if (string.IsNullOrWhiteSpace(fedOpts.GenericClientAssertion))\n                    throw new InvalidOperationException(\n                        \"Client assertion must be provided for generic workload federation scenario.\");\n                return fedOpts.GenericClientAssertion;\n\n            case WorkloadFederationScenario.ManagedIdentity:\n                Context.Trace.WriteLine(\n                    \"Getting client assertion for managed identity workload federation scenario...\");\n                var mi = ManagedIdentity.Create(fedOpts.ManagedIdentityId);\n                var miResult = await GetTokenForManagedIdentityAsync(fedOpts.Audience, mi);\n                return miResult.AccessToken;\n\n            case WorkloadFederationScenario.GitHubActions:\n                Context.Trace.WriteLine(\"Getting client assertion for GitHub Actions workload federation scenario...\");\n                return await GetGitHubOidcToken(fedOpts.GitHubTokenRequestUrl, fedOpts.Audience,\n                    fedOpts.GitHubTokenRequestToken);\n\n            default:\n                throw new ArgumentOutOfRangeException(nameof(fedOpts.Scenario), fedOpts.Scenario,\n                    \"Unsupported workload federation scenario.\");\n        }\n    }\n\n    private async Task<string> GetGitHubOidcToken(Uri requestUri, string audience, string requestToken)\n    {\n        using HttpClient http = Context.HttpClientFactory.CreateClient();\n\n        UriBuilder ub = new UriBuilder(requestUri);\n        if (ub.Query.Length > 0) ub.Query += \"&\";\n        ub.Query += $\"audience={Uri.EscapeDataString(audience)}\";\n\n        using var request = new HttpRequestMessage(HttpMethod.Get, ub.Uri);\n        request.AddBearerAuthenticationHeader(requestToken);\n\n        Context.Trace.WriteLine($\"Requesting GitHub OIDC token from '{request.RequestUri}'...\");\n        Context.Trace.WriteLineSecrets(\"OIDC request token: {0}\", new[] { requestToken });\n        using HttpResponseMessage response = await http.SendAsync(request);","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Core/Authentication/Entra/EntraAuthentication.ConfidentialClient.cs#L93-L129","documentation":"GetClientAssertion switches on the configured WorkloadFederationScenario and has cases for Generic, ManagedIdentity, and GitHubActions; any other value falls through to this ArgumentOutOfRangeException. It means the federation scenario enum value is not recognized.","triggerScenarios":"fedOpts.Scenario holds a value not handled by the switch (e.g. an out-of-range cast, default(enum) producing an undefined member, or a newly added enum value in a newer GCM being passed to an older build).","commonSituations":"Configuration parses an unknown scenario string into a bogus enum value; programmatic use constructs the enum incorrectly; version skew between a plugin/other component and the GCM assembly.","solutions":["Set the workload federation scenario to a supported value: Generic, ManagedIdentity, or GitHubActions","Fix how the scenario string is parsed/mapped into the enum (use TryParse with validation)","Align versions: rebuild/upgrade any component constructing WorkloadFederationScenario against the current GCM assembly","Inspect GCM trace output to see the offending scenario value"],"exampleFix":"// before\nvar scenario = (WorkloadFederationScenario)99;\n// after\nif (!Enum.TryParse<WorkloadFederationScenario>(configValue, ignoreCase: true, out var scenario) ||\n    !Enum.IsDefined(scenario)) throw new ArgumentException($\"Unknown scenario: {configValue}\");","handlingStrategy":"validation","validationCode":"if (!Enum.IsDefined(typeof(WorkloadFederationScenario), fedOpts.Scenario))\n    throw new ArgumentException($\"Unsupported federation scenario: {fedOpts.Scenario}\");","typeGuard":"bool IsValidScenario(WorkloadFederationScenario s) =>\n    s is WorkloadFederationScenario.Generic or WorkloadFederationScenario.ManagedIdentity or WorkloadFederationScenario.GitHubActions;","tryCatchPattern":"try { /* entra auth */ }\ncatch (ArgumentOutOfRangeException ex) when (ex.Message.Contains(\"Unsupported workload federation\")) { /* log fedOpts.Scenario and correct config */ }","preventionTips":["Only set scenario from validated config strings via Enum.TryParse + IsDefined","Keep GCM and any dependent components on compatible versions"],"tags":["enum","workload-identity-federation","argument-out-of-range","entra"],"backgroundTag":"invalid-enum-value","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}