Authorization Failure for Azure AD in GitHub Action Using az login

Question

Why is my GitHub action using az login failing with an authorization error in Azure Government?

 "PS - Based on common issues that we have seen from customers and other sources, we are posting these questions to help the Azure community."

Answer 1

Greetings!

The error "No matching federated identity record found for presented assertion subject" occurs when the federated identity credentials (Subject, Audience, and Issuer) configured in Azure AD do not match the presented assertion in the GitHub action. This mismatch prevents Azure AD from authorizing the login request.

To resolve this issue, ensure the following:

1. Verify that the federated identity credentials in Azure AD match the details in the presented assertion. This includes:
   • Subject: The claim should match the repository and environment in the GitHub action.
   • Audience: Ensure it is set correctly, typically api://AzureADTokenExchange.
   • Issuer: Should be https://token.actions.githubusercontent.com.
2. Double-check your GitHub action configuration to ensure the correct values are being used.

Here's a step-by-step approach:

• Navigate to the Azure AD App Registration.
• Under Certificates & secrets, verify the federated identity credentials.
• Ensure the subject claim in the GitHub action matches the expected value in Azure AD.

For more detailed guidance, you can follow the official documentation on Azure AD Workload Identity Federation.

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

Please do not forget to "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.