GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — App Registration Federated Credentials Using Custom Claim Expression Causes Internal Server Error · Issue #1359 · microsoftgraph/msgraph-sdk-python

App Registration Federated Credentials Using Custom Claim Expression Causes Internal Server Error #1359

New issue
Copy link
New issue
Copy link
Open
Open
App Registration Federated Credentials Using Custom Claim Expression Causes Internal Server Error#1359
Copy link
Labels
Service issuetype:bugA broken experienceA broken experience

Description

@brett-swan-sh
Brett Swan (brett-swan-sh)
opened on Sep 17, 2025
Issue body actions

Describe the bug

I am attempting to filter through all of my App Registrations that have Federated Credentials configured, but am getting an Internal Server Error from the API whenever a credential uses the Claim Matching Expressions functionality instead of an explicit subject value. For example, this is a problematic credential for the API:

Image

This results in the following response data from the API which the SDK cannot handle properly as it's not valid JSON:

{
  "@odata.context":"https://graph.microsoft.com/v1.0/$metadata#applications('<application id>')/federatedIdentityCredentials",
  "value":[
    {
      "id":"<credential id>",
      "name":"debug_v2",
      "issuer":"https://token.actions.githubusercontent.com"{"error":{"code":"InternalServerError","message":"The property 'subject[Nullable=False]' of type 'Edm.String' has a null value, which is not allowed.","innerError":{"date":"2025-09-17T21:05:59","request-id":"f1ffe8e1-f229-4ba1-83e6-69c64046e4a5","client-request-id":"f1ffe8e1-f229-4ba1-83e6-69c64046e4a5"}}}

You'll note that the value attribute would contain multiple other credentials (there are 3 on this app registration), but because of this error they're not visible at all. I don't think this is an issue with the SDK specifically, rather the Graph API it's using, but this seems like a reasonable place to report the issue since it's preventing SDK functionality from working properly.

Expected behavior

Claims matching expressions are supported in the JSON response for Federated Credentials

How to reproduce

GraphServiceClient(credentials=<credential>).applications.by_application_id(app_object_id).federated_identity_credentials.get()

where the app registration being queried has at least 1 federated credential using the "claims matching expression" feature.

SDK Version

1.2.0

Latest version known to work for scenario above?

No response

Known Workarounds

Haven't been able to find a way around other than finding the data manually through the portal

Debug output

Click to expand log ```
</details>


### Configuration

_No response_

### Other information

_No response_

Activity

  1. Brett Swan (brett-swan-sh)
    added
    status:waiting-for-triageAn issue that is yet to be reviewed or assignedAn issue that is yet to be reviewed or assigned
    type:bugA broken experienceA broken experience
    on Sep 17, 2025
  2. Luis Ramos (lramosvea)
    added
    Service issue
    and removed
    status:waiting-for-triageAn issue that is yet to be reviewed or assignedAn issue that is yet to be reviewed or assigned
    on May 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Service issuetype:bugA broken experienceA broken experience

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.