git-ecosystem/git-credential-manager · error · InvalidOperationException

Client assertion must be provided for generic workload…

Error message

Client assertion must be provided for generic workload federation scenario.

What it means

For the 'Generic' workload identity federation scenario, GCM must be handed a pre-obtained client assertion (a signed JWT) to exchange for tokens. This throws when credentialOptions.GenericClientAssertion is missing or whitespace, since there is nothing to authenticate with.

Solutions

1. Provide the client assertion via the GCM configuration option for the generic scenario (e.g. credential.workloadIdentity options carrying GenericClientAssertion)
2. Ensure the CI step that mints the OIDC/ID token runs before git/GCM and passes the token through
3. Fix the config key so the assertion is actually read into GenericClientAssertion
4. If you don't have a pre-minted assertion, use a supported scenario (GitHubActions or ManagedIdentity) instead of Generic

Example fix

// before
var fedOpts = new WorkloadIdentityCredentialOptions { Scenario = WorkloadFederationScenario.Generic };
// after
var fedOpts = new WorkloadIdentityCredentialOptions {
    Scenario = WorkloadFederationScenario.Generic,
    GenericClientAssertion = clientAssertionJwt // must be non-empty
};

if (fedOpts.Scenario == WorkloadFederationScenario.Generic && string.IsNullOrWhiteSpace(fedOpts.GenericClientAssertion))
    throw new InvalidOperationException("Generic workload federation requires GenericClientAssertion.");

bool HasClientAssertion(WorkloadIdentityCredentialOptions o) =>
    o.Scenario != WorkloadFederationScenario.Generic || !string.IsNullOrWhiteSpace(o.GenericClientAssertion);

try { /* entra auth */ }
catch (InvalidOperationException ex) when (ex.Message.Contains("Client assertion must be provided")) { /* mint or pass the assertion, then retry */ }

When it happens

Trigger: GetClientAssertion switch hits case WorkloadFederationScenario.Generic and string.IsNullOrWhiteSpace(fedOpts.GenericClientAssertion) is true — i.e. workload federation is configured as Generic but no client assertion option was supplied.

Common situations: Using GitHub/GitLab/Azure workload federation via GCM but forgetting to supply the OIDC-derived client assertion option; a CI script that failed to fetch the ID token before invoking GCM; typo'd configuration key so the assertion never reaches fedOpts.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• Unsupported workload federation scenario.
• Invalid response from GitHub OIDC token endpoint: 'value'…
• Missing or invalid interaction_mode in response
• No available interaction modes.
• Failed to enumerate all Git configuration entries

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/1bd8bc9ce6a366f6. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/Authentication/Entra/EntraAuthentication.ConfidentialClient.cs:94

            .WithClientAssertion(reqOpts => GetClientAssertion(fedOpts, reqOpts));

        IConfidentialClientApplication app = builder.Build();
        await RegisterCacheAsync(app);

        AuthenticationResult result = await app.AcquireTokenForClient(scopes)
            .ExecuteAsync(ct);

        return AuthResult.FromMsalResult(result);
    }

    private async Task<string> GetClientAssertion(WorkloadFederationOptions fedOpts, AssertionRequestOptions _)
    {
        switch (fedOpts.Scenario)
        {
            case WorkloadFederationScenario.Generic:
                Context.Trace.WriteLine("Getting client assertion for generic workload federation scenario...");
                if (string.IsNullOrWhiteSpace(fedOpts.GenericClientAssertion))
                    throw new InvalidOperationException(
                        "Client assertion must be provided for generic workload federation scenario.");
                return fedOpts.GenericClientAssertion;

            case WorkloadFederationScenario.ManagedIdentity:
                Context.Trace.WriteLine(
                    "Getting client assertion for managed identity workload federation scenario...");
                var mi = ManagedIdentity.Create(fedOpts.ManagedIdentityId);
                var miResult = await GetTokenForManagedIdentityAsync(fedOpts.Audience, mi);
                return miResult.AccessToken;

            case WorkloadFederationScenario.GitHubActions:
                Context.Trace.WriteLine("Getting client assertion for GitHub Actions workload federation scenario...");
                return await GetGitHubOidcToken(fedOpts.GitHubTokenRequestUrl, fedOpts.Audience,
                    fedOpts.GitHubTokenRequestToken);

            default:
                throw new ArgumentOutOfRangeException(nameof(fedOpts.Scenario), fedOpts.Scenario,
                    "Unsupported workload federation scenario.");

View on GitHub (pinned to e8ce762cd0)