Skip to content

opentofu init command doesn't work with OIDC token

Checklist

  • I'm using the latest version of the extension (Run glab --version)
    • Extension version: glab 1.67.0 (1e957280)
  • Operating system and version: MacOS Sequoia 15.6.1 (24G90)
  • Gitlab.com or self-managed instance? self-managed instance
  • GitLab version (if self-managed) 17.11.4-ee
  • I have performed glab auth status to check for authentication issues
  • Run the command in debug mode (like DEBUG=true glab mr list) and attach any useful output

Summary

Environment

  • OS: Darwin 24.6.0 arm64
  • SHELL: /bin/zsh
  • TERM: xterm-256color
  • GLAB: glab 1.67.0 (1e957280)%

Other:

Steps to reproduce

  1. Configure .config/glab-cli/config.yml for OIDC auth (OIDC token has api scope)
    1. unset GITLAB_ACCESS_TOKEN to make sure glab doesn't try to use that instead
  2. CD to local terraform\opentofu project and run glab opentofu init state-name

NOTE: If I export a personal access token with the api scope as GITLAB_ACCESS_TOKEN the init command works as expected.

What is the current bug behavior?

The init attempt fails with: Error refreshing state: HTTP remote state endpoint requires auth

What is the expected correct behavior?

Should properly use OIDC token to auth against remote state backend. (preferred, if possible)

OR

Should output error message about OIDC token not being supported for remote state auth and that a personal access token is required instead. (Only if OIDC token is truly not compatible with remote state.)

Relevant logs and/or screenshots

DEBUG=true glab opentofu init staging
[git remote -v]
[git config --get-regexp ^remote\..*\.glab-resolved$]
2025/08/28 10:21:37 Could not parse telemetry config value  - defaulting to 'true'

Initializing the backend...
Error refreshing state: HTTP remote state endpoint requires auth
ERROR: exit status 1

Possible fixes

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information