azd login with federated credential fails because the subject is scoped to the GitHub environment name

[puicchan]

GitHub environments allows for gated approval stages.

Now azd login with federated credential fails because the subject is scoped to the GitHub environment name:

AADSTS700213: No matching federated identity record found for presented assertion subject 'repo:JeffreyCA/azd-dev-prod:environment:dev'. Check your federated identity credential Subject, Audience and Issuer against the presented assertion.

[weikanglim]

Reading through the GitHub OpenID Connect docs, I'm not immediately seeing how azd would influence the subject used here.

I believe the subject claims are automatically populated based on the runtime context of the GitHub workflow.

As a first step to move towards resolution, I'd recommend using the oidc-debugger to see what the auto-generated subject looks like. My hunch is that the workflow is running in a non-environment context that wouldn't match the Azure configuration.

[JeffreyCA]

With oidc-debugger, the value of sub when an environment is not specified looks like: repo:JeffreyCA/dev-prod-single:ref:refs/heads/main (triggered from push to main branch)

When an environment is specified (e.g. prod), then sub looks like: repo:JeffreyCA/dev-prod-single:environment:prod.

  oidc_debug_test:
    runs-on: ubuntu-latest
    environment:
      name: prod
    permissions:
      contents: read
      id-token: write
    name: A test of the oidc debugger
    steps:
      - name: Debug OIDC Claims
        uses: github/actions-oidc-debugger@main
        with:
          audience: '${{ github.server_url }}/${{ github.repository_owner }}'

I was exploring the possibility of azd pipeline config generating an azure-dev.yml GitHub Action workflow that sets environment to ${{ vars.AZURE_ENV_NAME }} and as part of the "Federated User Managed Identity (MSI + OIDC)" setup flow, create an additional federated credential with the subject identifier repo:JeffreyCA/dev-prod-single:environment:<env-name>.

If azd doesn't do this for the user, then I think they have to manually create the federated credential in Azure for azd login to work if they're using GitHub Environments. Not sure if that clarifies things?

[weikanglim]

Thanks for the explanation @JeffreyCA! That does clear things up.

possibility of azd pipeline config [to] create an additional federated credential with the subject identifier repo:JeffreyCA/dev-prod-single:environment:.

This does make sense, and the minimal feature ask would be along the lines of:

• feature: azd pipeline config should allow for generating GitHub environment-specific credentials.

One thing to keep in mind is that azd's notion of an environment name is currently "globally unique", and usually prefixed with some unique identifier like myproject-dev, whereas it may be expected that in github, this would be just dev/int/prod. Another observation is that pull request workflows for CI would also behave differently, if that is of interest.

[weikanglim]

See related:

#2373
#3585

One immediate question that I don't yet have an answer for is whether the current single pipeline config workflow that does everything from SP creation, auth setup will compose well with N number of environments and stages.