Skip to content

fix: immutable subject claim - #138

Merged
Zhangqi910 merged 4 commits into
Azure:mainfrom
richeney:immutable-subject-claim
Jul 31, 2026
Merged

fix: immutable subject claim#138
Zhangqi910 merged 4 commits into
Azure:mainfrom
richeney:immutable-subject-claim

Conversation

@richeney

@richeney richeney commented Jul 23, 2026 •
edited by Zhangqi910
Loading

Copy link
Copy Markdown
Contributor

Overview/Summary

Updated federated credential subjects for immutable organization and repo references, meeting the requirement for the GitHub platform change in https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens

This PR fixes/adds/changes/removes

  1. Fixes [Bug]: Immutable subject claims Azure-Landing-Zones#4223

Breaking Changes

  1. Assumes that ALZ Accelerator is creating a new repo and therefore immutable subject claim is required.

Testing Evidence

  • Full test run iof ALZ Accelerator.
  • Checked the federadted credentials that were created.
  • Ran the CI and CD workflows

As part of this Pull Request I have

  • Checked for duplicate Pull Requests
  • Associated it with relevant issues, for tracking and closure.
  • Ensured my code/branch is up-to-date with the latest changes in the main branch
  • Performed testing and provided evidence.
  • Updated relevant and associated documentation.

@richeney richeney changed the title immutable subject claim fix: immutable subject claim Jul 23, 2026
@richeney

richeney commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

It looks as if #135 is in a similar but unrelated area. I suggest that the two changes are combined.

(Daniel's change is compensating for variance in username / org name case, as opposed to the immutable claim format, but they both change the subject.)

@DanielBoring @Y1ngJ1eChen
fix(github): use API-resolved org login for OIDC subject claims
7c17aef 
Use data.github_organization.alz.login instead of var.organization_name when constructing OIDC subject claims for federated credentials.

This preserves exact org casing in the repo: segment to match GitHub token assertions and avoid AADSTS7002138 case-sensitive matching failures.

Also lower-case the org in job_workflow_ref template composition to align with observed GitHub token behavior for reusable workflow refs.
@Y1ngJ1eChen
Y1ngJ1eChen requested review from Y1ngJ1eChen and Zhangqi910 and removed request for Y1ngJ1eChen and Zhangqi910 July 30, 2026 05:36
@Y1ngJ1eChen
Support legacy and immutable OIDC subjects
47a6658 
Generate both legacy name-based and immutable ID-based GitHub Actions OIDC
subject claims for each workflow and environment mapping.

Keep the legacy subject on the existing key and add an immutable subject with
a distinct key. This preserves authentication for existing repositories while
supporting repositories that use GitHub's immutable OIDC subject format.
yeddlapurishivasai
yeddlapurishivasai reviewed Jul 31, 2026
View reviewed changes
Comment thread modules/github/locals.tf Outdated
@Zhangqi910
Zhangqi910 merged commit 068f74c into Azure:main Jul 31, 2026
8 checks passed
@Zhangqi910 Zhangqi910 mentioned this pull request Jul 31, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yeddlapurishivasai yeddlapurishivasai yeddlapurishivasai approved these changes
@Zhangqi910 Zhangqi910 Zhangqi910 approved these changes
@akshayrohilla akshayrohilla Awaiting requested review from akshayrohilla

Assignees

No one assigned

Labels

None yet

Projects

Azure Landing Zone Issues & PRs Triage
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: Immutable subject claims

5 participants

@richeney @yeddlapurishivasai @Zhangqi910 @DanielBoring @Y1ngJ1eChen