oauth2-proxy/oauth2-proxy · error

error reading federated token file %s: %s

Error message

error reading federated token file %s: %s

What it means

redeemWithFederatedToken performs Entra client-assertion authentication using workload identity federation: it reads the federated credential JWT from the path in the AZURE_FEDERATED_TOKEN_FILE environment variable. If the file cannot be read (missing, unreadable, wrong path), Redeem fails with this wrapped error naming the path and OS error.

Source

Thrown at providers/ms_entra_id.go:117

	return p.OIDCProvider.ValidateSession(ctx, session)
}

// Redeem exchanges the OAuth2 authentication token for an ID token, considering federated token authentication
func (p *MicrosoftEntraIDProvider) Redeem(ctx context.Context, redirectURL, code, codeVerifier string) (*sessions.SessionState, error) {
	if p.federatedTokenAuth {
		return p.redeemWithFederatedToken(ctx, redirectURL, code, codeVerifier)
	}

	return p.OIDCProvider.Redeem(ctx, redirectURL, code, codeVerifier)
}

// redeemWithFederatedToken performs custom token exchange with federated token instead of client secret
func (p *MicrosoftEntraIDProvider) redeemWithFederatedToken(ctx context.Context, redirectURL, code, codeVerifier string) (*sessions.SessionState, error) {
	federatedTokenPath := os.Getenv("AZURE_FEDERATED_TOKEN_FILE")
	// #nosec G703 -- AZURE_FEDERATED_TOKEN_FILE is set by the operator, not user input
	federatedToken, err := os.ReadFile(federatedTokenPath)
	if err != nil {
		return nil, fmt.Errorf("error reading federated token file %s: %s", federatedTokenPath, err)
	}

	params := url.Values{}

	// Exchange parameters for token federation
	// https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-access-token-with-a-certificate-credential
	if codeVerifier != "" {
		params.Add("code_verifier", codeVerifier)
	}
	params.Add("redirect_uri", redirectURL)
	params.Add("client_id", p.ClientID)
	params.Add("client_assertion", string(federatedToken))
	params.Add("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
	params.Add("code", code)
	params.Add("grant_type", "authorization_code")

	token, err := p.fetchToken(ctx, params)
	if err != nil {

View on GitHub (pinned to 33c2eb92de)

Solutions

1. Set AZURE_FEDERATED_TOKEN_FILE to the projected service-account token path (in AKS: /var/run/secrets/azure/tokens/azure-identity-token).
2. Confirm the volume/CSI driver mounting the federated token is configured and the file exists: 'ls -l $AZURE_FEDERATED_TOKEN_FILE'.
3. Check file permissions so the process user can read the token file.
4. If not using workload identity federation, disable the federated-token mode so Redeem uses the client secret path instead.

Example fix

// before
# deployment yaml: env AZURE_FEDERATED_TOKEN_FILE not set
// after
env:
  - name: AZURE_FEDERATED_TOKEN_FILE
    value: /var/run/secrets/azure/tokens/azure-identity-token

tokenPath := os.Getenv("AZURE_FEDERATED_TOKEN_FILE")
if tokenPath == "" { return errors.New("AZURE_FEDERATED_TOKEN_FILE must be set for federated token exchange") }
if _, err := os.Stat(tokenPath); err != nil {
    return fmt.Errorf("federated token file %s not readable: %w", tokenPath, err)
}

s, err := provider.Redeem(ctx, redirectURL, code)
if err != nil && strings.Contains(err.Error(), "error reading federated token file") {
    log.Fatalf("federated credential misconfigured: %v", err)
}

When it happens

Trigger: Redeem -> redeemWithFederatedToken (federated-token mode enabled) with AZURE_FEDERATED_TOKEN_FILE unset (path empty) or pointing to a nonexistent/unreadable file, so os.ReadFile returns an error.

Common situations: Running outside Azure Kubernetes Service where the projected service-account token file doesn't exist; env var forgotten in the deployment manifest; file not yet mounted at container start; permissions changed on the mounted token path.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

• error fetching token: %w
• unable to enrich session: %v
• unable to check token: %v
• unable to redeem refresh token: %v
• unable to load config file: %w

AI-assisted analysis of oauth2-proxy/oauth2-proxy@33c2eb92de (2026-09-06). Data as JSON: /api/errors/7c7a1bac24132d2f. Report an issue: GitHub.