OIDC workload identities: A trailing asterisk in SUBJECT is a prefix wildcard (Pending)¶

When the 2026_08 bundle is enabled, a single trailing * in SUBJECT for an OIDC workload identity matches any token subject with that prefix. A subject that already ends in * starts accepting a wider set of tokens. You can also set CLAIMS so the token must match extra claims exactly.

Before the change:

SUBJECT matches the token sub claim exactly, and a trailing * is a literal asterisk. CLAIMS is rejected.

Copy code

ALTER USER example_service_user ADD WORKLOAD IDENTITY github_actions
  TYPE = OIDC
  ISSUER = 'https://token.actions.githubusercontent.com'
  SUBJECT = 'repo:example/workload:*';
-- Matches only the token subject repo:example/workload:*

After the change:

The same SUBJECT matches any token subject that starts with repo:example/workload:.

A new SUBJECT must be at least three characters. A trailing * needs at least three characters before it, and a * anywhere except the end is rejected. An identity already stored with a subject that isn’t valid wildcard syntax still matches that subject exactly.

CLAIMS requires exact matches on additional token claims. Two identities for the same issuer can use overlapping subjects only when their CLAIMS require different values for one shared claim.

Copy code

ALTER USER example_service_user ADD WORKLOAD IDENTITY github_actions
  TYPE = OIDC
  ISSUER = 'https://token.actions.githubusercontent.com'
  SUBJECT = 'repo:example/workload:*'
  CLAIMS = ('repository_id' = '12345678');
-- Matches any token subject that starts with repo:example/workload:
-- and whose repository_id claim is 12345678

How to update your code¶

List OIDC workload identities whose SUBJECT ends in *. If that asterisk was a literal character, replace the identity with a subject that doesn’t end in * before you enable the 2026_08 bundle. After the bundle is enabled, a trailing * can only be stored as a wildcard.

Ref: 2461