Skip to content

fix: immutable subject claim - #138

Merged
Zhangqi910 merged 4 commits into
Azure:mainfrom
richeney:immutable-subject-claim
Jul 31, 2026
Merged

fix: immutable subject claim#138
Zhangqi910 merged 4 commits into
Azure:mainfrom
richeney:immutable-subject-claim

Conversation

@richeney

@richeney richeney commented Jul 23, 2026 •
edited by Zhangqi910
Loading

Copy link
Copy Markdown
Contributor

Overview/Summary

Updated federated credential subjects for immutable organization and repo references, meeting the requirement for the GitHub platform change in https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens

This PR fixes/adds/changes/removes

  1. Fixes [Bug]: Immutable subject claims Azure-Landing-Zones#4223

Breaking Changes

  1. Assumes that ALZ Accelerator is creating a new repo and therefore immutable subject claim is required.

Testing Evidence

  • Full test run iof ALZ Accelerator.
  • Checked the federadted credentials that were created.
  • Ran the CI and CD workflows

As part of this Pull Request I have

  • Checked for duplicate Pull Requests
  • Associated it with relevant issues, for tracking and closure.
  • Ensured my code/branch is up-to-date with the latest changes in the main branch
  • Performed testing and provided evidence.
  • Updated relevant and associated documentation.

@richeney richeney changed the title immutable subject claim fix: immutable subject claim Jul 23, 2026
@richeney

richeney commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

It looks as if #135 is in a similar but unrelated area. I suggest that the two changes are combined.

(Daniel's change is compensating for variance in username / org name case, as opposed to the immutable claim format, but they both change the subject.)

@DanielBoring @Y1ngJ1eChen
fix(github): use API-resolved org login for OIDC subject claims
7c17aef 
Use data.github_organization.alz.login instead of var.organization_name when constructing OIDC subject claims for federated credentials.

This preserves exact org casing in the repo: segment to match GitHub token assertions and avoid AADSTS7002138 case-sensitive matching failures.

Also lower-case the org in job_workflow_ref template composition to align with observed GitHub token behavior for reusable workflow refs.
@Y1ngJ1eChen
Y1ngJ1eChen requested review from Y1ngJ1eChen and Zhangqi910 and removed request for Y1ngJ1eChen and Zhangqi910 July 30, 2026 05:36
@Y1ngJ1eChen
Support legacy and immutable OIDC subjects
47a6658 
Generate both legacy name-based and immutable ID-based GitHub Actions OIDC
subject claims for each workflow and environment mapping.

Keep the legacy subject on the existing key and add an immutable subject with
a distinct key. This preserves authentication for existing repositories while
supporting repositories that use GitHub's immutable OIDC subject format.
yeddlapurishivasai
yeddlapurishivasai reviewed Jul 31, 2026
View reviewed changes
Comment thread modules/github/locals.tf Outdated
@Zhangqi910
Zhangqi910 merged commit 068f74c into Azure:main Jul 31, 2026
8 checks passed
@Zhangqi910 Zhangqi910 mentioned this pull request Jul 31, 2026
Merged
@Y1ngJ1eChen Y1ngJ1eChen mentioned this pull request Aug 3, 2026
Closed
@richeney
richeney deleted the immutable-subject-claim branch August 3, 2026 09:24
@richeney

richeney commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

@Zhangqi910 & @Y1ngJ1eChen - note that ALZ Accelerator's GitHub workflows are currently failing for release v7.2.1 without this fix. When will a new release be created?

Example error message:

No matching federated identity record found for presented assertion subject 'repo:richeney-org@219859934/alz-mgmt@1321673051:environment:alz-mgmt-plan:job_workflow_ref:richeney-org/alz-mgmt-templates/.github/workflows/ci-template.yaml@refs/heads/main'. Check your federated identity credential Subject, Audience and Issuer against the presented assertion.

In the meantime, users can work around this by running:

gh api repos/<org>/<repo> --jq '"repo:" + .owner.login + "@" + (.owner.id|tostring) + "/" + .name + "@" + (.id|tostring)'

Example output

repo:richeney-org@219859934/alz-mgmt@1321673051

Then manually update the repo section of the subject in the federated credentials for the managed identities. Or update using the GitHub account details fields as per the image below.

Org and Repo ID fields for an immutable subject claim.

There are three federated credentials across the plan and apply managed identities.

@Zhangqi910

Zhangqi910 commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

@Zhangqi910 & @Y1ngJ1eChen - note that ALZ Accelerator's GitHub workflows are currently failing for release v7.2.1 without this fix. When will a new release be created?

Example error message:

No matching federated identity record found for presented assertion subject 'repo:richeney-org@219859934/alz-mgmt@1321673051:environment:alz-mgmt-plan:job_workflow_ref:richeney-org/alz-mgmt-templates/.github/workflows/ci-template.yaml@refs/heads/main'. Check your federated identity credential Subject, Audience and Issuer against the presented assertion.

In the meantime, users can work around this by running:

gh api repos/<org>/<repo> --jq '"repo:" + .owner.login + "@" + (.owner.id|tostring) + "/" + .name + "@" + (.id|tostring)'

Example output

repo:richeney-org@219859934/alz-mgmt@1321673051

Then manually update the repo section of the subject in the federated credentials for the managed identities. Or update using the GitHub account details fields as per the image below.

Org and Repo ID fields for an immutable subject claim. There are three federated credentials across the plan and apply managed identities.

@richeney , we're planning to create a new release today.

@richeney

richeney commented Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

I see that is is live: https://github.com/Azure/accelerator-bootstrap-modules/releases/tag/7.3.0.

I'll retest a new deployment for Management Only.

@richeney

richeney commented Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

@Zhangqi910 would you retag the release? It is set to 7.3.0 but the accelerator modules expect it to be in the v7.3.0 format.

The accelerator is hitting https://api.github.com/repos/Azure/accelerator-bootstrap-modules/releases/tags/v7.3.0 and is getting a 404.

@Zhangqi910

Zhangqi910 commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

@Zhangqi910 would you retag the release? It is set to 7.3.0 but the accelerator modules expect it to be in the v7.3.0 format.

The accelerator is hitting https://api.github.com/repos/Azure/accelerator-bootstrap-modules/releases/tags/v7.3.0 and is getting a 404.

@richeney thanks for catching this, I retagged the release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yeddlapurishivasai yeddlapurishivasai yeddlapurishivasai approved these changes
@Zhangqi910 Zhangqi910 Zhangqi910 approved these changes
@akshayrohilla akshayrohilla Awaiting requested review from akshayrohilla

Assignees

No one assigned

Labels

None yet

Projects

Azure Landing Zone Issues & PRs Triage
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: Immutable subject claims

5 participants

@richeney @Zhangqi910 @yeddlapurishivasai @DanielBoring @Y1ngJ1eChen