{"record":{"id":"c378111ecf01d262","repo":"hashicorp/terraform","slug":"mismatch-between-supplied-oidc-token-and-oidc-toke","errorCode":null,"errorMessage":"mismatch between supplied OIDC token and OIDC token file contents provided by AKS Workload Identity - please either remove one, ensure they match, or disable use_aks_workload_identity","messagePattern":"mismatch between supplied OIDC token and OIDC token file contents provided by AKS Workload Identity - please either remove one, ensure they match, or disable use_aks_workload_identity","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/helpers.go","lineNumber":74,"sourceCode":"\t\tif idToken != \"\" && idToken != fileToken {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied OIDC token and supplied OIDC token file contents - please either remove one or ensure they match\")\n\t\t}\n\n\t\tidToken = fileToken\n\t}\n\n\tif d.Bool(\"use_aks_workload_identity\") && os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\") != \"\" {\n\t\tpath := os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\")\n\t\tfileTokenRaw, err := os.ReadFile(os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\"))\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading OIDC Token from file %q provided by AKS Workload Identity: %v\", path, err)\n\t\t}\n\n\t\tfileToken := strings.TrimSpace(string(fileTokenRaw))\n\n\t\tif idToken != \"\" && idToken != fileToken {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied OIDC token and OIDC token file contents provided by AKS Workload Identity - please either remove one, ensure they match, or disable use_aks_workload_identity\")\n\t\t}\n\n\t\tidToken = fileToken\n\t}\n\n\treturn &idToken, nil\n}\n\nfunc getClientId(d *backendbase.SDKLikeData) (*string, error) {\n\tclientId := strings.TrimSpace(d.String(\"client_id\"))\n\n\tif path := d.String(\"client_id_file_path\"); path != \"\" {\n\t\tfileClientIdRaw, err := os.ReadFile(path)\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading Client ID from file %q: %v\", path, err)\n\t\t}\n","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/helpers.go#L56-L92","documentation":"In the AKS-workload-identity branch of getOidcToken (helpers.go:74), if an OIDC token was already resolved (from oidc_token or oidc_token_file_path) and it differs from the token read from AZURE_FEDERATED_TOKEN_FILE, the backend aborts rather than silently overriding it.","triggerScenarios":"use_aks_workload_identity=true, AZURE_FEDERATED_TOKEN_FILE is set, and an inline oidc_token or oidc_token_file_path value that does not match the AKS-injected federated token is also present.","commonSituations":"Mixing a manually-supplied OIDC token with AKS workload identity; a token rotated externally that no longer matches the federated credential; left-over config from a non-AKS environment.","solutions":["Remove oidc_token / oidc_token_file_path when using AKS workload identity and let the federated token file be the single source.","If both must stay, ensure the supplied token equals the contents of AZURE_FEDERATED_TOKEN_FILE.","Disable use_aks_workload_identity if you intend to supply the token manually."],"exampleFix":"# before\nterraform {\n  backend \"azurerm\" {\n    use_aks_workload_identity = true\n    oidc_token                = \"eyJ...manual\"\n  }\n}\n# after\nterraform {\n  backend \"azurerm\" {\n    use_aks_workload_identity = true\n  }\n}","handlingStrategy":"validation","validationCode":"# ensure no conflicting inline token when AKS workload identity is used\nif [ \"${TF_VAR_use_aks_workload_identity:-false}\" = \"true\" ] && [ -n \"$AZURE_FEDERATED_TOKEN_FILE\" ]; then\n  [ -z \"${TF_VAR_oidc_token:-}\" ] || { echo \"remove oidc_token when using AKS workload identity\" >&2; exit 1; }\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not set oidc_token when relying on AKS workload identity.","Let AZURE_FEDERATED_TOKEN_FILE be the single token source in AKS."],"tags":["azure","oidc","aks","workload-identity","config"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}