git-ecosystem/git-credential-manager · error · ArgumentOutOfRangeException

Unsupported workload federation scenario.

Error message

Unsupported workload federation scenario.

What it means

GetClientAssertion switches on the configured WorkloadFederationScenario and has cases for Generic, ManagedIdentity, and GitHubActions; any other value falls through to this ArgumentOutOfRangeException. It means the federation scenario enum value is not recognized.

Solutions

  1. Set the workload federation scenario to a supported value: Generic, ManagedIdentity, or GitHubActions
  2. Fix how the scenario string is parsed/mapped into the enum (use TryParse with validation)
  3. Align versions: rebuild/upgrade any component constructing WorkloadFederationScenario against the current GCM assembly
  4. Inspect GCM trace output to see the offending scenario value

Example fix

// before
var scenario = (WorkloadFederationScenario)99;
// after
if (!Enum.TryParse<WorkloadFederationScenario>(configValue, ignoreCase: true, out var scenario) ||
    !Enum.IsDefined(scenario)) throw new ArgumentException($"Unknown scenario: {configValue}");
Defensive patterns

Strategy: validation

Validate before calling

if (!Enum.IsDefined(typeof(WorkloadFederationScenario), fedOpts.Scenario))
    throw new ArgumentException($"Unsupported federation scenario: {fedOpts.Scenario}");

Type guard

bool IsValidScenario(WorkloadFederationScenario s) =>
    s is WorkloadFederationScenario.Generic or WorkloadFederationScenario.ManagedIdentity or WorkloadFederationScenario.GitHubActions;

Try / catch

try { /* entra auth */ }
catch (ArgumentOutOfRangeException ex) when (ex.Message.Contains("Unsupported workload federation")) { /* log fedOpts.Scenario and correct config */ }

Prevention

When it happens

Trigger: fedOpts.Scenario holds a value not handled by the switch (e.g. an out-of-range cast, default(enum) producing an undefined member, or a newly added enum value in a newer GCM being passed to an older build).

Common situations: Configuration parses an unknown scenario string into a bogus enum value; programmatic use constructs the enum incorrectly; version skew between a plugin/other component and the GCM assembly.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/abd5fe3903fa2d08. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/Authentication/Entra/EntraAuthentication.ConfidentialClient.cs:111

                if (string.IsNullOrWhiteSpace(fedOpts.GenericClientAssertion))
                    throw new InvalidOperationException(
                        "Client assertion must be provided for generic workload federation scenario.");
                return fedOpts.GenericClientAssertion;

            case WorkloadFederationScenario.ManagedIdentity:
                Context.Trace.WriteLine(
                    "Getting client assertion for managed identity workload federation scenario...");
                var mi = ManagedIdentity.Create(fedOpts.ManagedIdentityId);
                var miResult = await GetTokenForManagedIdentityAsync(fedOpts.Audience, mi);
                return miResult.AccessToken;

            case WorkloadFederationScenario.GitHubActions:
                Context.Trace.WriteLine("Getting client assertion for GitHub Actions workload federation scenario...");
                return await GetGitHubOidcToken(fedOpts.GitHubTokenRequestUrl, fedOpts.Audience,
                    fedOpts.GitHubTokenRequestToken);

            default:
                throw new ArgumentOutOfRangeException(nameof(fedOpts.Scenario), fedOpts.Scenario,
                    "Unsupported workload federation scenario.");
        }
    }

    private async Task<string> GetGitHubOidcToken(Uri requestUri, string audience, string requestToken)
    {
        using HttpClient http = Context.HttpClientFactory.CreateClient();

        UriBuilder ub = new UriBuilder(requestUri);
        if (ub.Query.Length > 0) ub.Query += "&";
        ub.Query += $"audience={Uri.EscapeDataString(audience)}";

        using var request = new HttpRequestMessage(HttpMethod.Get, ub.Uri);
        request.AddBearerAuthenticationHeader(requestToken);

        Context.Trace.WriteLine($"Requesting GitHub OIDC token from '{request.RequestUri}'...");
        Context.Trace.WriteLineSecrets("OIDC request token: {0}", new[] { requestToken });
        using HttpResponseMessage response = await http.SendAsync(request);

View on GitHub (pinned to e8ce762cd0)