WIF still requires client secret

Question

WIF still requires client secret

Geo Cheng 10

I set up WIF (GCP -> Azure authentication) with a federated credential, enabled “Allow public client flows”, and are using urn:ietf:params:oauth:grant-type:jwt-bearer, but Azure AD still requires a client_secret.

Here's the Correlation ID: 079b7a59-1d58-4467-bf44-e4ece63ce5ed and Trace ID: 'e034c167-9fb3-4afc-9b15-c9cf7e161200' from the latest error.

Can you please check for the application in question (gcp-azure-connector, or ID 5e042850-28d3-4f19-b4de-6b9936c08041) on why it still requires client_secret for WIF auth?

e.g. internal tenant policies, permission logs, or propagation issues that might be blocking WIF from working without client secret

Sridevi Machavarapu 4,610 Reputation points Volunteer Moderator

2025-03-20T09:08:46.5166667+00:00

Hello Geo Cheng,

Could you check and confirm what platform your redirect URI is configured in your Azure AD app registration? If possible, please add Authentication tab image of your Azure app registration to check redirect URI field and “Allow public client flows” option.
Sridevi Machavarapu 4,610 Reputation points Volunteer Moderator

2025-03-21T00:49:04.6933333+00:00

Hello Geo Cheng,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Sridevi Machavarapu 4,610 Reputation points Volunteer Moderator

2025-03-26T02:30:21.1533333+00:00

Hello Geo Cheng,

Could you share more details on how this setup was configured? Specifically, any documentation you followed and a diagram of the authentication flow. This will help us reproduce the issue and troubleshoot effectively.
Geo Cheng 10 Reputation points

2025-03-26T04:48:21.2333333+00:00

I provided those trace_id and correlation_id in the error message - are you able to find some glues from the azure server side?

Here are the detailed steps of what I did to setup the azure side. Let me know if you need my GCP setup steps as well. Note that I did not perform the redirect URI step 5 as grok keeps telling me it's not needed, and I don't know how to set that up anyway with a webserver that I don't have. For step 6 and 7, my cloud admin said he couldn't find a way to assign a role to an application anyway, so I wasn't able to do those 2 steps.

Summary of Steps to Reproduce AADSTS7000219 Error in GCP-to-Azure WIF Setup

Objective

The goal was to set up Workload Identity Federation (WIF) to allow a workload running on a GCP VM to authenticate to Azure AD and access Azure resources (e.g., list subscriptions) without using a client_secret. The setup uses the urn:ietf:params:oauth:grant-type:jwt-bearer grant type to exchange a GCP token for an Azure AD token. However, the process consistently resulted in the error AADSTS7000219: 'client_assertion' or 'client_secret' is required, indicating Azure AD requires client authentication despite the WIF configuration.

see screenshot for the steps, i couldn't paste them here becuz of formatting issues [removed image later for sensitive info]

1 answer

Your answer

Sridevi Machavarapu 4,610 Reputation points Volunteer Moderator

2025-03-20T09:08:46.5166667+00:00

Hello Geo Cheng,

Could you check and confirm what platform your redirect URI is configured in your Azure AD app registration? If possible, please add Authentication tab image of your Azure app registration to check redirect URI field and “Allow public client flows” option.
Sridevi Machavarapu 4,610 Reputation points Volunteer Moderator

2025-03-21T00:49:04.6933333+00:00

Hello Geo Cheng,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Sridevi Machavarapu 4,610 Reputation points Volunteer Moderator

2025-03-26T02:30:21.1533333+00:00

Hello Geo Cheng,

Could you share more details on how this setup was configured? Specifically, any documentation you followed and a diagram of the authentication flow. This will help us reproduce the issue and troubleshoot effectively.
Geo Cheng 10 Reputation points

2025-03-26T04:48:21.2333333+00:00

I provided those trace_id and correlation_id in the error message - are you able to find some glues from the azure server side?

Here are the detailed steps of what I did to setup the azure side. Let me know if you need my GCP setup steps as well. Note that I did not perform the redirect URI step 5 as grok keeps telling me it's not needed, and I don't know how to set that up anyway with a webserver that I don't have. For step 6 and 7, my cloud admin said he couldn't find a way to assign a role to an application anyway, so I wasn't able to do those 2 steps.

Summary of Steps to Reproduce AADSTS7000219 Error in GCP-to-Azure WIF Setup

Objective

The goal was to set up Workload Identity Federation (WIF) to allow a workload running on a GCP VM to authenticate to Azure AD and access Azure resources (e.g., list subscriptions) without using a client_secret. The setup uses the urn:ietf:params:oauth:grant-type:jwt-bearer grant type to exchange a GCP token for an Azure AD token. However, the process consistently resulted in the error AADSTS7000219: 'client_assertion' or 'client_secret' is required, indicating Azure AD requires client authentication despite the WIF configuration.

see screenshot for the steps, i couldn't paste them here becuz of formatting issues [removed image later for sensitive info]

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

5 deleted comments

Comments have been turned off. Learn more