{"record":{"id":"f2f5ccb59d4db05e","repo":"hashicorp/terraform","slug":"reading-oidc-token-from-file-q-v","errorCode":null,"errorMessage":"reading OIDC Token from file %q: %v","messagePattern":"reading OIDC Token from file %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/helpers.go","lineNumber":51,"sourceCode":"\tif clientCertificate != \"\" {\n\t\tout := make([]byte, base64.StdEncoding.DecodedLen(len(clientCertificate)))\n\t\tn, err := base64.StdEncoding.Decode(out, []byte(clientCertificate))\n\t\tif err != nil {\n\t\t\treturn pfx, fmt.Errorf(\"could not decode client certificate data: %v\", err)\n\t\t}\n\t\tpfx = out[:n]\n\t}\n\treturn pfx, nil\n}\n\nfunc getOidcToken(d *backendbase.SDKLikeData) (*string, error) {\n\tidToken := strings.TrimSpace(d.String(\"oidc_token\"))\n\n\tif path := d.String(\"oidc_token_file_path\"); path != \"\" {\n\t\tfileTokenRaw, err := os.ReadFile(path)\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading OIDC Token from file %q: %v\", path, err)\n\t\t}\n\n\t\tfileToken := strings.TrimSpace(string(fileTokenRaw))\n\n\t\tif idToken != \"\" && idToken != fileToken {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied OIDC token and supplied OIDC token file contents - please either remove one or ensure they match\")\n\t\t}\n\n\t\tidToken = fileToken\n\t}\n\n\tif d.Bool(\"use_aks_workload_identity\") && os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\") != \"\" {\n\t\tpath := os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\")\n\t\tfileTokenRaw, err := os.ReadFile(os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\"))\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading OIDC Token from file %q provided by AKS Workload Identity: %v\", path, err)\n\t\t}","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/helpers.go#L33-L69","documentation":"Raised by the Azure remote-state backend's getOidcToken helper (helpers.go:51) when the backend option `oidc_token_file_path` is set but os.ReadFile fails to read that file. The file is expected to contain a JWT OIDC token used for federated/workload-identity auth against Azure Storage; the underlying OS error (no such file, permission denied, is a directory) is wrapped into the message.","triggerScenarios":"Configuring `terraform { backend \"azurerm\" {} }` (or the azurerm auth block of the remote backend) with `oidc_token_file_path` pointing at a path that does not exist, is not readable by the terraform process, or names a directory, then running terraform init.","commonSituations":"CI/locally using a stale file path from another pipeline; the file path set via an env var that was never populated in the current shell; a Kubernetes mounted-secret path that differs from the config; typos or trailing whitespace in the path.","solutions":["Verify the path exists and is readable: `test -r \"$path\" && echo ok`.","Run terraform as a user/uid that has read permission on the token file.","If sourcing the token dynamically, unset oidc_token_file_path and use a credential process / env var instead.","Fix typos, trailing whitespace, or an incorrect volume-mount path in the configured value."],"exampleFix":"# before\nterraform {\n  backend \"azurerm\" {\n    oidc_token_file_path = \"/var/run/secrets/tokn\"  # typo\n  }\n}\n# after\nterraform {\n  backend \"azurerm\" {\n    oidc_token_file_path = \"/var/run/secrets/token\"\n  }\n}","handlingStrategy":"validation","validationCode":"# preflight before `terraform init`\nf=\"${TF_VAR_oidc_token_file_path:-/var/run/secrets/oidc/token}\"\nif [ -n \"$TF_VAR_oidc_token_file_path\" ] || [ -n \"$oidc_token_file_path\" ]; then\n  test -r \"$f\" || { echo \"oidc token file not readable: $f\" >&2; exit 1; }\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate backend file paths in CI before terraform init.","Mount secrets as files in CI rather than copying token strings around.","Keep a single source of truth for the OIDC token."],"tags":["azure","oidc","config","authentication","file-io"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}