We use CircleCI OIDC to authenticate deploys to AWS, and it works well there - our IAM trust policy uses a StringLike condition to wildcard the user/ part of the subject, so any authorized pipeline run can assume the role.
We’re now trying to do the same thing against Azure, and we’ve hit a wall. Azure’s workload identity federation requires an exact match on the subject claim. Because your sub is org//project//user/ and the user segment changes per person, there’s no practical way to match it.
You already let us customize the aud claim via the CLI, so the plumbing to issue a customized token clearly exists. What we’re after is the ability to override or omit the user/ segment in sub and get a stable, project- or org-scoped subject instead (e.g. org//project/). That one change would make Azure federation work the same way AWS does for us today.
Two questions:
1. Is there any supported way to do this now that I’ve missed?
2. If not, is a configurable/scoped subject claim something on the roadmap?
For context, Azure’s flexible federated credentials do support wildcard matching, but the issuer allowlist is currently GitHub, GitLab and Terraform Cloud but CircleCI isn’t on it. So getting CircleCI added there would also solve it, if that’s a conversation you’re able to have with Microsoft.
