Bitbucket Pipelines Variables and OIDC seem to not work together

[Alin Turbut]

I am having an issue where if I use variables on a step that is also using oidc: true, the OIDC part is not available.

I am getting the following error: 

An error occurred (InvalidIdentityToken) when calling the AssumeRoleWithWebIdentity operation: No OpenIDConnect provider found in your account for https://api.bitbucket.org/2.0/workspaces/WORKSPACE/pipelines-config/identity/oidc

Any known fix for this?

[Alin Turbut · Accepted solution]

Found out the real issue.

Basically one of my variables was AWS_PROFILE and even though it was the correct one, I think it has somes conflicts with awscli in the idea that it is misconfiguring for the OpenID Connect.

[Phil C]

Hi Alin,

Welcome to the community!

The "InvalidIdentityToken" error occurs when there is a mismatch in the audience claim within the identity token used during deployment. The audience claim indicates who the token is intended for and must correspond with the client ID issued by your application's identity provider. If the audience claim in the identity token does not match the expected client ID for the IAM role in AWS, the AssumeRoleWithWebIdentity operation will fail, generating an "Incorrect token audience" error message.

The following steps should help address the issue,

1. Check the audience displayed as the identity provider in OpenID Connect on Bitbucket.
2. Verify that the audience value matches your app's client ID from the identity provider.
3. If the audience value is incorrect, update it by copying the correct OpenID Connect value from Bitbucket into the audience field.

Reference - Troubleshooting pipeline build failing with "An error occurred (InvalidIdentityToken) when calling the AssumeRoleWithWebIdentity operation: Incorrect token audience"

I hope this helps.

- Phil

[Alin Turbut]

Phil,

Thanks a lot for getting back.

Wouldn't this also reproduce for the same pipeline (same code) but without using variables? Which is not the case, I can definitely run the pipeline without variables.

In any case, I have double checked the audience and everything seems correct. Again, I can run the pipeline, but without variables and "hard-coding" the values from the variables.