Unclear error when subject isnt correct

[gz]

I had a subject of form repo:org/repo missing e.g., a :* at the end
the error you get from this action in this case is not very helpful/misleading:

▶️ get tailscale status
Daemon ready! Initial state: NeedsLogin
✅ tailscaled daemon is up and running!
▶️ hostname
Attempt 1 to bring up Tailscale...
▶️ tailscale up
Warning: Tailscale up attempt 1 failed: sudo failed with exit code 1
Retrying in 2 seconds...
Attempt 2 to bring up Tailscale...
▶️ tailscale up
Warning: Tailscale up attempt 2 failed: sudo failed with exit code 1
Retrying in 4 seconds...
Attempt 3 to bring up Tailscale...
▶️ tailscale up
Warning: Tailscale up attempt 3 failed: sudo failed with exit code 1
Retrying in 6 seconds...
Attempt 4 to bring up Tailscale...
▶️ tailscale up
Warning: Tailscale up attempt 4 failed: sudo failed with exit code 1
Retrying in 8 seconds...
Attempt 5 to bring up Tailscale...
▶️ tailscale up
Warning: Tailscale up attempt 5 failed: sudo failed with exit code 1
Error: sudo failed with exit code 1

[mpminardi]

Thanks for flagging this @gz ! We're aware that this (and debugging incorrect setup in general) is a rough edge currently for workload identity and are looking at improving this.

[eliart20]

How rough is this edge currently?

[mpminardi]

@gz we've got some documentation around improvements for debugging token exchange errors here that should hopefully be helpful in the future.

TL;DR: the trust credential in the admin console will display error information from the latest token exchange attempt (including for when the subject is mismatched between the value in the token and the expectation in the matching rule on the Tailscale side).