GCloud workload-identity-pools providers create-oidc INVALID_ARGUMENT error

[sam-nash]

Select Topic Area

Question

Body

Hi Team,

I am trying to set up things to be able to run Actions to query gcloud.
As part of the set up, I have so far been able to Create a Workload Identity Pool but when I try to Create a Workload Identity Provider using the command below, it fails with an error "ERROR: (gcloud.iam.workload-identity-pools.providers.create-oidc) INVALID_ARGUMENT: The attribute condition must reference one of the provider's claims. For more information, see https://cloud.google.com/iam/docs/workload-identity-federation-with-deployment-pipelines#conditions"

Command

gcloud iam workload-identity-pools providers create-oidc "github-actions-provider" \
    --project="my-project-name" \
    --location="global" \
    --workload-identity-pool="github-actions" \
    --display-name="GitHub Actions Provider" \
    --issuer-uri="https://token.actions.githubusercontent.com" \
    --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner"

I inspected the OIDC JWT Claims by running the command below and I can confirm the the claims have the sub, repository, actor and repository_owner coming up in the response.

OIDC_JWT=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN"
"$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)

Can someone please throw some light on this issue and help me fix what I may have missed.

Thank you

[ferid333]

Hello @sam-nash!
It looks like the error you're encountering is related to the attribute-mapping in your gcloud command. The issue is with the condition in the attribute mapping, which must directly reference claims provided by the OIDC token from GitHub Actions.

Here’s how to troubleshoot and potentially fix this issue:

Steps to Resolve:

1. Check the Claims Available in OIDC Token:
   You’ve already done the right thing by inspecting the OIDC JWT claims. Make sure the claims you’re referencing (assertion.sub, assertion.actor, assertion.repository, and assertion.repository_owner) are present in the OIDC JWT token and properly formatted.

2. Review Attribute Mapping:
   The error suggests that your attribute-mapping may not correctly align with the available claims. Make sure that the mapping matches the exact claims from the token. For example, the correct attribute mappings for GitHub Actions should look like this:

   --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.job_workflow_ref=assertion.job_workflow_ref"

   If your repository_owner claim doesn’t exist or isn’t being returned in the token, you can remove it or replace it with job_workflow_ref which is commonly available in the claims.

3. Adjust the Attribute Condition (Optional):
   If you're using conditions in your Workload Identity Pool setup, make sure the conditions reference valid claims from the OIDC provider (GitHub in this case). For example, if you want to restrict access to a specific repository, you could modify your condition like this:

   --attribute-condition="attribute.repository=='<your-org>/<your-repo>'"

4. Retry the Command:
   Once you’ve verified the claims and adjusted the attribute mapping, try rerunning the command:

   gcloud iam workload-identity-pools providers create-oidc "github-actions-provider" \
       --project="my-project-name" \
       --location="global" \
       --workload-identity-pool="github-actions" \
       --display-name="GitHub Actions Provider" \
       --issuer-uri="https://token.actions.githubusercontent.com" \
       --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.job_workflow_ref=assertion.job_workflow_ref"

[oshriza]

It does not work also for me, in my case, I'm doing it from the GCP UI and I already created provider for my identity pool, but I forgot to add some att (attribute.repository), so I edited it, and I saw the following error:

Failed to add the identity provider.
Error code: 400. The attribute condition must reference one of the provider's claims. For more information, see https://cloud.google.com/iam/docs/workload-identity-federation-with-deployment-pipelines#conditions

Tracking number: c7111599542253349

So I delete the provider and I create it again to make another try, but now I cannot create a provider with github oidc at all, even with minimal configuration like only sub and aud.
everytime, I got the same error.
Is something changed or happened, how can we check that?

[sam-nash]

So I finally got this to work by specifying attribute-condition additionally.

[oshriza]

Hi @sam-nash ,
Can you explain or send what you did?
Thanks

[sam-nash]

I have attached screenshots of OIDC Provider page

[oshriza]

It works!! Thank you
Its weird bug!!!!
If it still does not work to someone after you did like @sam-nash did - try different name for the provider. (Not your previous name)

Thanks @sam-nash

[sam-nash]

Thats strange that it didnt work with the same name(after deleting and recreating). Because I did the same thing and it didnt throw any errors to me

[selimacerbas]

You saved so much time, Thanks for the pictures.

[ShaharSaadon]

thanks so much.... i tried to find a solution for this for days

[bunnis]

I'm having the same problem, using https://token.actions.githubusercontent.com/.well-known/openid-configuration accepts the claims, however when trying to use it I get this error https://cloud.google.com/iam/docs/troubleshooting-workload-identity-federation#error-connecting-issuer

[oshriza]

Is it when you trying to configure oidc in gcp?
If so, did you check also like this way?

https://token.actions.githubusercontent.com

I think the issuer should be like this, but maybe I'm wrong and it can configure both ways.

[bunnis]

Yes I also checked that way and yes I configure in the GUI. The manuals all state that it has to be configured as you stated.

[mattfeldhake]

I'm having the same problem from both the GCP UI and the gcloud command line. We have other providers that have been set up in the past with the same configurations.

[sam-nash]

try adding audience as well to the mapping and see if it resolves.

[mattfeldhake]

adding an attribute condition worked. Thanks for the help!

[AmitArie]

@mattfeldhake can you elaborate please?

[mattfeldhake]

@AmitArie to get this to work I had to add an Attribute Condition (attribute.repository=='{org}/{repo}') to the provider. I assume this requirement was put into place for security reasons.