hashicorp/terraform · error

mismatch between supplied Client ID and supplied Client ID f

Error message

mismatch between supplied Client ID and supplied Client ID file contents - please either remove one or ensure they match

What it means

getClientId (helpers.go:96) rejects the configuration when both `client_id` and `client_id_file_path` are supplied and the two values differ after trimming. The backend will not guess which ID to use.

Source

Thrown at internal/backend/remote-state/azure/helpers.go:96

	}

	return &idToken, nil
}

func getClientId(d *backendbase.SDKLikeData) (*string, error) {
	clientId := strings.TrimSpace(d.String("client_id"))

	if path := d.String("client_id_file_path"); path != "" {
		fileClientIdRaw, err := os.ReadFile(path)

		if err != nil {
			return nil, fmt.Errorf("reading Client ID from file %q: %v", path, err)
		}

		fileClientId := strings.TrimSpace(string(fileClientIdRaw))

		if clientId != "" && clientId != fileClientId {
			return nil, fmt.Errorf("mismatch between supplied Client ID and supplied Client ID file contents - please either remove one or ensure they match")
		}

		clientId = fileClientId
	}

	if d.Bool("use_aks_workload_identity") && os.Getenv("AZURE_CLIENT_ID") != "" {
		aksClientId := os.Getenv("AZURE_CLIENT_ID")
		if clientId != "" && clientId != aksClientId {
			return nil, fmt.Errorf("mismatch between supplied Client ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity")
		}
		clientId = aksClientId
	}

	return &clientId, nil
}

func getClientSecret(d *backendbase.SDKLikeData) (*string, error) {
	clientSecret := strings.TrimSpace(d.String("client_secret"))

View on GitHub (pinned to c9def3e214)

Solutions

1. Provide only one of client_id or client_id_file_path.
2. If both must remain, make the inline value exactly equal to the file contents (after trimming).
3. Re-export the correct client ID into the single source you keep.

Example fix

# before
backend "azurerm" {
  client_id           = "11111111-1111-1111-1111-111111111111"
  client_id_file_path = "/etc/azure/client-id"   # holds a different GUID
}
# after
backend "azurerm" {
  client_id_file_path = "/etc/azure/client-id"
}

# ensure client_id and client_id_file_path agree, or only one is set
cid="${TF_VAR_client_id:-}"
file="${TF_VAR_client_id_file_path:-}"
if [ -n "$cid" ] && [ -n "$file" ]; then
  fc="$(tr -d '[:space:]' < "$file")"
  [ "$cid" = "$fc" ] || { echo "client id / file mismatch" >&2; exit 1; }
fi

When it happens

Trigger: Setting client_id inline and client_id_file_path simultaneously in the backend block (or env) with non-identical values.

Common situations: Rotating the app registration but updating only the inline value; copy-paste of a wrong GUID; env var left over from a different tenant.

Related errors

• reading Client ID from file %q: %v
• reading OIDC Token from file %q: %v
• mismatch between supplied OIDC token and supplied OIDC token
• mismatch between supplied Client ID and that provided by AKS
• reading Client Secret from file %q: %v

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/9eb01b65b5ebca6a. Report an issue: GitHub.