WIF still requires client secret

Question

I set up WIF (GCP -> Azure authentication) with a federated credential, enabled “Allow public client flows”, and are using urn:ietf:params:oauth:grant-type:jwt-bearer, but Azure AD still requires a client_secret.

Here's the Correlation ID: 079b7a59-1d58-4467-bf44-e4ece63ce5ed and Trace ID: 'e034c167-9fb3-4afc-9b15-c9cf7e161200' from the latest error.

Can you please check for the application in question (gcp-azure-connector, or ID 5e042850-28d3-4f19-b4de-6b9936c08041) on why it still requires client_secret for WIF auth?

e.g. internal tenant policies, permission logs, or propagation issues that might be blocking WIF from working without client secret

Answer 1

Hello Geo Cheng,

Thanks for sharing the details. It looks like Azure AD is still asking for a client secret, even though Workload Identity Federation should work without one.

This could be because Azure isn’t recognizing the GCP token correctly. Checking that the issuer, subject, and audience match what's registered in Azure under Federated Credentials might help.

It could also be an issue with the OAuth request, as Azure expects client_credentials instead of jwt-bearer. If the service principal lacks the right permissions, like Reader or Contributor access, Azure will issue a token but throws error while calling API request.

Here’s an updated version of your script that should work better:

import requests

# Get GCP token

metadata_url = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity"

audience = "//iam.googleapis.com/projects/3xxxxxxxxx9/locations/global/workloadIdentityPools/azure-ad-pool-1/providers/azure-ad-provider-1"

gcp_response = requests.get(f"{metadata_url}?audience={audience}", headers={"Metadata-Flavor": "Google"})

if gcp_response.status_code != 200:

    print(f"Error getting GCP token: {gcp_response.text}")

    exit(1)

gcp_token = gcp_response.text

# Exchange GCP token for Azure token

azure_token_url = "https://login.microsoftonline.com/tenantId/oauth2/v2.0/token"

azure_client_id = "appId"

data = {

    "grant_type": "client_credentials",

    "client_id": azure_client_id,

    "client_assertion": gcp_token,

    "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",

    "scope": "https://management.azure.com/.default"

}

azure_response = requests.post(azure_token_url, headers={"Content-Type": "application/x-www-form-urlencoded"}, data=data)

if azure_response.status_code != 200:

    print(f"Azure AD Error: {azure_response.json()}")

    exit(1)

azure_ad_token = azure_response.json()["access_token"]

# Test Azure AD token

headers = {'Authorization': f'Bearer {azure_ad_token}'}

response = requests.get("https://management.azure.com/subscriptions?api-version=2020-01-01", headers=headers)

print(response.json())

To know how to generate access token using federated credentials, you can refer this MS Article: Access Token Request with a Federated Credential.

Hope this helps!

---

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.