hashicorp/terraform · error

mismatch between supplied OIDC token and OIDC token file con

Error message

mismatch between supplied OIDC token and OIDC token file contents provided by AKS Workload Identity - please either remove one, ensure they match, or disable use_aks_workload_identity

What it means

In the AKS-workload-identity branch of getOidcToken (helpers.go:74), if an OIDC token was already resolved (from oidc_token or oidc_token_file_path) and it differs from the token read from AZURE_FEDERATED_TOKEN_FILE, the backend aborts rather than silently overriding it.

Source

Thrown at internal/backend/remote-state/azure/helpers.go:74

		if idToken != "" && idToken != fileToken {
			return nil, fmt.Errorf("mismatch between supplied OIDC token and supplied OIDC token file contents - please either remove one or ensure they match")
		}

		idToken = fileToken
	}

	if d.Bool("use_aks_workload_identity") && os.Getenv("AZURE_FEDERATED_TOKEN_FILE") != "" {
		path := os.Getenv("AZURE_FEDERATED_TOKEN_FILE")
		fileTokenRaw, err := os.ReadFile(os.Getenv("AZURE_FEDERATED_TOKEN_FILE"))

		if err != nil {
			return nil, fmt.Errorf("reading OIDC Token from file %q provided by AKS Workload Identity: %v", path, err)
		}

		fileToken := strings.TrimSpace(string(fileTokenRaw))

		if idToken != "" && idToken != fileToken {
			return nil, fmt.Errorf("mismatch between supplied OIDC token and OIDC token file contents provided by AKS Workload Identity - please either remove one, ensure they match, or disable use_aks_workload_identity")
		}

		idToken = fileToken
	}

	return &idToken, nil
}

func getClientId(d *backendbase.SDKLikeData) (*string, error) {
	clientId := strings.TrimSpace(d.String("client_id"))

	if path := d.String("client_id_file_path"); path != "" {
		fileClientIdRaw, err := os.ReadFile(path)

		if err != nil {
			return nil, fmt.Errorf("reading Client ID from file %q: %v", path, err)
		}

View on GitHub (pinned to c9def3e214)

Solutions

1. Remove oidc_token / oidc_token_file_path when using AKS workload identity and let the federated token file be the single source.
2. If both must stay, ensure the supplied token equals the contents of AZURE_FEDERATED_TOKEN_FILE.
3. Disable use_aks_workload_identity if you intend to supply the token manually.

Example fix

# before
terraform {
  backend "azurerm" {
    use_aks_workload_identity = true
    oidc_token                = "eyJ...manual"
  }
}
# after
terraform {
  backend "azurerm" {
    use_aks_workload_identity = true
  }
}

# ensure no conflicting inline token when AKS workload identity is used
if [ "${TF_VAR_use_aks_workload_identity:-false}" = "true" ] && [ -n "$AZURE_FEDERATED_TOKEN_FILE" ]; then
  [ -z "${TF_VAR_oidc_token:-}" ] || { echo "remove oidc_token when using AKS workload identity" >&2; exit 1; }
fi

When it happens

Trigger: use_aks_workload_identity=true, AZURE_FEDERATED_TOKEN_FILE is set, and an inline oidc_token or oidc_token_file_path value that does not match the AKS-injected federated token is also present.

Common situations: Mixing a manually-supplied OIDC token with AKS workload identity; a token rotated externally that no longer matches the federated credential; left-over config from a non-AKS environment.

Related errors

• reading OIDC Token from file %q provided by AKS Workload Ide
• mismatch between supplied Client ID and that provided by AKS
• mismatch between supplied Tenant ID and that provided by AKS
• reading OIDC Token from file %q: %v
• mismatch between supplied OIDC token and supplied OIDC token

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/c378111ecf01d262. Report an issue: GitHub.