{"record":{"id":"b9b086106000f726","repo":"hashicorp/terraform","slug":"mismatch-between-supplied-client-secret-and-suppli","errorCode":null,"errorMessage":"mismatch between supplied Client Secret and supplied Client Secret file contents - please either remove one or ensure they match","messagePattern":"mismatch between supplied Client Secret and supplied Client Secret file contents - please either remove one or ensure they match","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/helpers.go","lineNumber":126,"sourceCode":"\t}\n\n\treturn &clientId, nil\n}\n\nfunc getClientSecret(d *backendbase.SDKLikeData) (*string, error) {\n\tclientSecret := strings.TrimSpace(d.String(\"client_secret\"))\n\n\tif path := d.String(\"client_secret_file_path\"); path != \"\" {\n\t\tfileSecretRaw, err := os.ReadFile(path)\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading Client Secret from file %q: %v\", path, err)\n\t\t}\n\n\t\tfileSecret := strings.TrimSpace(string(fileSecretRaw))\n\n\t\tif clientSecret != \"\" && clientSecret != fileSecret {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Client Secret and supplied Client Secret file contents - please either remove one or ensure they match\")\n\t\t}\n\n\t\tclientSecret = fileSecret\n\t}\n\n\treturn &clientSecret, nil\n}\n\nfunc getTenantId(d *backendbase.SDKLikeData) (*string, error) {\n\ttenantId := strings.TrimSpace(d.String(\"tenant_id\"))\n\n\tif d.Bool(\"use_aks_workload_identity\") && os.Getenv(\"AZURE_TENANT_ID\") != \"\" {\n\t\taksTenantId := os.Getenv(\"AZURE_TENANT_ID\")\n\t\tif tenantId != \"\" && tenantId != aksTenantId {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Tenant ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity\")\n\t\t}\n\t\ttenantId = aksTenantId\n\t}","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/helpers.go#L108-L144","documentation":"getClientSecret (helpers.go:126) rejects the configuration when both `client_secret` and `client_secret_file_path` are supplied with differing values after trimming. The backend will not guess which secret to use.","triggerScenarios":"Setting client_secret inline and client_secret_file_path simultaneously in the backend block (or env) with non-identical values.","commonSituations":"Secret rotation updated only one source; a stale inline secret left in version control; env var drift between environments.","solutions":["Provide only one of client_secret or client_secret_file_path.","If both must remain, make the inline value byte-identical (after trimming) to the file contents.","Rotate and re-export the secret into a single source."],"exampleFix":"# before\nbackend \"azurerm\" {\n  client_secret           = \"OLD-SECRET\"\n  client_secret_file_path = \"/etc/azure/client-secret\"  # NEW-SECRET\n}\n# after\nbackend \"azurerm\" {\n  client_secret_file_path = \"/etc/azure/client-secret\"\n}","handlingStrategy":"validation","validationCode":"# ensure client_secret and client_secret_file_path agree, or only one is set\nsec=\"${TF_VAR_client_secret:-}\"\nfile=\"${TF_VAR_client_secret_file_path:-}\"\nif [ -n \"$sec\" ] && [ -n \"$file\" ]; then\n  fs=\"$(tr -d '[:space:]' < \"$file\")\"\n  [ \"$sec\" = \"$fs\" ] || { echo \"client secret / file mismatch\" >&2; exit 1; }\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provide only one client-secret source.","Rotate secrets in a single coordinated step across all sources."],"tags":["azure","client-secret","config","authentication"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}