Secretless authentication — quick notes
Secretless authentication — quick notes
| Step | Detail |
|---|---|
| 1 | Establish provider-side OIDC trust |
| 2 | With permissions: id-token: write, request GitHub's per-job OIDC JWT identity assertion |
| 3 | Present that JWT to the cloud provider |
| 4 | Receive a distinct short-lived cloud access token valid for that job |
Three documented benefits: no long-lived cloud secret · provider-managed authN/authZ · rotating short-lived credentials.
- Match trust against the token's audience and actual subject.
- An environment claim is present only when the job references an environment.
- Repositories created after
2026-07-15use immutable owner/repository IDs in the default subject. id-token: writepermits requesting the JWT; it grants neither repository nor cloud-resource write access.- Azure Pipelines uses WIF with an app registration or managed identity; new eligible connections use the Microsoft Entra issuer.
- Convert eligible connections flagged for the deprecated Azure DevOps issuer in place.
Trap: broad organization trust or a copied name-only subject can authorize unintended workflows.
Primary sources: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400 · https://docs.github.com/en/actions/concepts/security/openid-connect · https://docs.github.com/en/actions/reference/security/oidc · https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-azure · https://learn.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/pipelines/release/configure-workload-identity?view=azure-devops