{"record":{"id":"ae7eb3346a9d329e","repo":"git-ecosystem/git-credential-manager","slug":"invalid-managed-identity-id-id","errorCode":null,"errorMessage":"Invalid managed identity id '{id}'","messagePattern":"Invalid managed identity id '(.+?)'","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Core/Authentication/Entra/ManagedIdentity.cs","lineNumber":27,"sourceCode":"\n    public static readonly ManagedIdentity System = new(\"system\", ManagedIdentityId.SystemAssigned);\n\n    public static ManagedIdentity FromClientId(Guid clientId)\n    {\n        var id = clientId.ToString(\"D\");\n        return new($\"id://{id}\", ManagedIdentityId.WithUserAssignedClientId(id));\n    }\n\n    public static ManagedIdentity FromResourceId(Guid resourceId)\n    {\n        var id = resourceId.ToString(\"D\");\n        return new($\"resource://{id}\", ManagedIdentityId.WithUserAssignedResourceId(id));\n    }\n\n    public static ManagedIdentity Create(string id) =>\n        TryCreate(id, out ManagedIdentity mi)\n            ? mi\n            : throw new ArgumentException($\"Invalid managed identity id '{id}'\", nameof(id));\n\n    public static bool TryCreate(string id, out ManagedIdentity mi)\n    {\n        if (string.IsNullOrWhiteSpace(id))\n        {\n            mi = null;\n            return false;\n        }\n\n        if (StringComparer.OrdinalIgnoreCase.Equals(id, \"system\"))\n        {\n            mi = System;\n            return true;\n        }\n\n        // {uuid} => user-assigned client ID\n        if (Guid.TryParse(id, out Guid guid))\n        {","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Core/Authentication/Entra/ManagedIdentity.cs#L9-L45","documentation":"ManagedIdentity.Create validates the user-supplied managed identity identifier and throws ArgumentException when TryCreate rejects it. A valid id is either 'system' (system-assigned), a GUID (interpreted as a user-assigned client ID), or an 'id://{uuid}' or 'resource://{uuid}' URI. Anything else — empty, whitespace, or a non-GUID string without a valid scheme — is rejected.","triggerScenarios":"Calling ManagedIdentity.Create with an empty/whitespace string, a non-GUID name (e.g. the resource's human-readable name), or a malformed URI like 'resource://not-a-guid' or 'clientid://...'.","commonSituations":"Users entering a managed identity display name instead of its client ID or resource ID; typos or truncation of the GUID; copying an ARM resource path ('/subscriptions/.../resourcegroups/...') rather than the expected 'resource://{uuid}' form; environment variable containing blank value.","solutions":["Pass 'system' for a system-assigned managed identity.","Pass the user-assigned identity's client ID as a GUID string, or a 'id://{guid}' / 'resource://{guid}' URI.","Use ManagedIdentity.TryCreate or Guid.TryParse/Uri validation on the value before calling Create.","Check the Azure portal/CLI for the correct client ID or resource ID of the user-assigned identity."],"exampleFix":"// before\nvar mi = ManagedIdentity.Create(identityName); // \"my-identity\" -> ArgumentException\n// after\nvar mi = Guid.TryParse(clientId, out _) || clientId.Equals(\"system\", StringComparison.OrdinalIgnoreCase)\n    ? ManagedIdentity.Create(clientId)\n    : ManagedIdentity.Create($\"resource://{resourceIdGuid}\");","handlingStrategy":"validation","validationCode":"if (string.IsNullOrWhiteSpace(id) ||\n    !(id.Equals(\"system\", StringComparison.OrdinalIgnoreCase) ||\n      Guid.TryParse(id, out _) ||\n      (Uri.TryCreate(id, UriKind.Absolute, out var u) &&\n       (u.Scheme.Equals(\"id\", StringComparison.OrdinalIgnoreCase) || u.Scheme.Equals(\"resource\", StringComparison.OrdinalIgnoreCase)))))\n    throw new ArgumentException($\"Invalid managed identity id '{id}'\");","typeGuard":"static bool IsValidManagedIdentityId(string id) =>\n    !string.IsNullOrWhiteSpace(id) &&\n    (id.Equals(\"system\", StringComparison.OrdinalIgnoreCase) ||\n     Guid.TryParse(id, out _) ||\n     (Uri.TryCreate(id, UriKind.Absolute, out var u) &&\n      (u.Scheme.Equals(\"id\", OrdinalIgnoreCase) || u.Scheme.Equals(\"resource\", OrdinalIgnoreCase)) && Guid.TryParse(u.Host, out _)));","tryCatchPattern":"try\n{\n    mi = ManagedIdentity.Create(id);\n}\ncatch (ArgumentException ex)\n{\n    Console.Error.WriteLine($\"Identity id '{id}' invalid: use 'system', a GUID client id, or id://resource:// URI.\");\n    return;\n}","preventionTips":["Use the Azure CLI (az identity show) to fetch the correct client ID or resource ID GUID.","Never pass the identity's display name as the id.","Prefer ManagedIdentity.TryCreate for user-supplied values.","Trim and validate environment-provided identity values before use."],"tags":["managed-identity","azure","invalid-argument","identifier-format"],"backgroundTag":"invalid-identifier-format","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}