Fixing AADSTS70021 Federated Identity Errors

DEV Community

AADSTS70021 no matching federated identity record found, and its two siblings

AADSTS70021 no matching federated identity record found is Microsoft Entra ID saying it received a token from GitHub and could find no federated credential on the application whose issuer, subject and audience all matched it. The same sentence is carried by two other codes that do name which of the three was wrong, so the digits are the diagnosis and the words are shared. The framed line is quoted from Azure/azure-dev#5473. The other two codes were recorded in Azure/azure-cli#25178 and JulianHayward/AzAPICall#54. What this error means A cloud login step fails after the OIDC token has been minted, which means the GitHub half worked. The message begins with a code and then a sentence about a presented assertion. Take the code apart before reading the sentence. The five-digit AADSTS70021 arrives with no detail about what failed to match. The six-digit AADSTS700212 continues ... presented assertion audience and then the audience it saw. The six-digit AADSTS700213 continues ... presented assertion subject and then the subject in quotes, usually with a follow-on sentence telling you to check the credential's subject, audience and issuer against it. The longer codes are far more useful, and a report quoting one of them as the other loses the only distinguishing information in the message. ```Quoted from Azure/azure-dev#5473; Entra ID is a closed service and this is a third-party report of its output AADSTS700213: No matching federated identity record found for presented assertion subject 'repo:JeffreyCA/azd-dev-prod:environment:dev'. Check your federated identity credential Subject, Audience and Issuer against the presented assertion.

Common causes

The subject changed because the trigger or the environment changed

The largest cause, and usually the result of an edit that looked unrelated. Adding an environment: to a job, deploying from a tag as well as a branch, or moving a job into a reusable workflow all change the generated subject, while the credential still matches the old one. The code that names the subject quotes the new value straight back at you.

No credential exists for this repository at all

The plain case: the application was created, the workflow was written, and the federated credential step was skipped or applied to a different application. In our experience this is what the bare five-digit code most often turns out to be, since it offers no detail to narrow it with.

The issuer was stored with a trailing slash or a typo

A hand-copied URL that looks correct. Microsoft's own CLI documentation carried a sample with a trailing slash, which produced this error for anyone who followed it, and the correction was raised as a pull request against the docs rather than against any code.

The audience is wrong for this cloud

The global value is not universal. A sovereign tenant expects its own audience, and a workflow using the default sends something that tenant will never match. The code that names the audience prints the value it received, which distinguishes this from a subject problem immediately.

How to fix it

Read the code, not the sentence

1. Take the digits after AADSTS and stop reading the shared sentence.
2. On a code naming the subject, copy the quoted subject verbatim; that is the exact string a credential must carry.
3. On a code naming the audience, compare the printed audience against what your tenant expects.
4. On the bare five-digit code, you have no detail, so check all three fields of the credential in turn.

Register a credential for the subject the run actually presented

Create the federated credential with the subject taken out of the error message, the fixed GitHub issuer, and the audience your cloud uses. Pasting the subject rather than retyping it removes the whole class of near-miss mistakes.

```Federated identity credential (illustrative)
{
"name": "gha-environment-dev",
"issuer": "https://token.actions.githubusercontent.com",
"subject": "re...

Powered by Readybot.io