Overview
This article addresses the InvalidIdentityToken error encountered when using CircleCI Server's OpenID Connect (OIDC) tokens on AWS. The error typically occurs during the AssumeRoleWithWebIdentity operation and is often due to misconfigurations in the JSON Web Key (JWK) or AWS settings.
Prerequisites
CircleCI Server v4.4.0 or later
AWS account with permissions to configure Identity Providers and IAM Roles.
Access to CircleCI Web application for organization settings
Helm for managing Kubernetes applications
OIDC is enable on Helm Values
oidc_service.isEnabled: true
Solution
If you encounter the following error, it is likely due to missing fields in the JSON Web Key (JWK) that was set on oidc.json_web_keys. Ensure that the alg and kid fields are present in the JWK. Follow the steps below to regenerate and correctly configure the JWK.
An error occurred (InvalidIdentityToken) when calling the AssumeRoleWithWebIdentity operation: Couldn't retrieve verification key from your identity provider, please reference AssumeRoleWithWebIdentity documentation for requirements