rancher/rancher · error

invalid clientSecret

Error message

invalid clientSecret

What it means

Final required-field check in getCredentialsFromBody (handler.go:336): subscriptionId, tenantId and clientId are present but clientSecret is empty, returning 400 'invalid clientSecret'. This mirrors error 100 but for the inline-body flow used by AKS lister endpoints rather than the credential-check endpoint.

Source

Thrown at pkg/api/norman/customization/aks/handler.go:337

	if err != nil {
		return http.StatusBadRequest, fmt.Errorf("cannot read request body: %v", err)
	}

	if err = json.Unmarshal(raw, &cap); err != nil {
		return http.StatusBadRequest, fmt.Errorf("cannot parse request body: %v", err)
	}

	if cap.SubscriptionID == "" {
		return http.StatusBadRequest, fmt.Errorf("invalid subscriptionId")
	}
	if cap.TenantID == "" {
		return http.StatusBadRequest, fmt.Errorf("invalid tenantId")
	}
	if cap.ClientID == "" {
		return http.StatusBadRequest, fmt.Errorf("invalid clientId")
	}
	if cap.ClientSecret == "" {
		return http.StatusBadRequest, fmt.Errorf("invalid clientSecret")
	}

	clientEnvironment := ""
	if cap.Environment != "" {
		clientEnvironment = cap.Environment
	}
	_, azureEnvironment := GetEnvironment(clientEnvironment)

	if cap.BaseURL == "" {
		cap.BaseURL = azureEnvironment.ResourceManagerEndpoint
	}
	if cap.AuthBaseURL == "" {
		cap.AuthBaseURL = azureEnvironment.ActiveDirectoryEndpoint
	}

	return http.StatusOK, nil
}

View on GitHub (pinned to 932558d4e6)

Solutions

1. Add clientSecret to the inline body with the current secret value from App registrations > Certificates & secrets
2. On edit flows, re-send the secret (or fetch it from your secret store) - the API has no 'keep existing' for inline bodies
3. Verify the key is exactly clientSecret and the value has no leading/trailing whitespace stripped by shell interpolation

Example fix

// before
const body = { subscriptionId, tenantId, clientId }; // edit flow omitted secret
// after
const body = { subscriptionId, tenantId, clientId, clientSecret: await vault.read('azure/creds') };

if (!body.clientSecret || !String(body.clientSecret).trim()) throw new Error('clientSecret is required on every inline request');

function hasClientSecret(b) { return typeof b?.clientSecret === 'string' && b.clientSecret.trim() !== ''; }

if (!hasClientSecret(body)) { body.clientSecret = await vault.read('azure/clientSecret'); }
const resp = await post(listEndpoint, body);

When it happens

Trigger: Inline payload includes the three GUIDs but omits the secret, or the secret field name is misspelled/cased differently so it unmarshals to "".

Common situations: Secret left blank because the UI treats it as 'unchanged' on edit while the API expects it always; automation where the secret variable is empty in CI; secrets stored in a vault never fetched into the payload.

Related errors

• must provide clientSecret
• invalid subscriptionId
• invalid tenantId
• invalid clientId
• region is required

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/5b910b9b31b3521e. Report an issue: GitHub.