{"record":{"id":"0280eba16079d837","repo":"hashicorp/nomad","slug":"failed-to-login-with-jwt-v","errorCode":null,"errorMessage":"failed to login with JWT: %v","messagePattern":"failed to login with JWT: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/vaultclient/vaultclient.go","lineNumber":159,"sourceCode":"\t\treturn \"\", false, 0, err\n\t}\n\n\t// Make sure the login request is not passing any token and that we're using\n\t// the expected namespace to login\n\tcc.SetToken(\"\")\n\tif req.Namespace != \"\" {\n\t\tcc.SetNamespace(req.Namespace)\n\t}\n\n\tjwtLoginPath := fmt.Sprintf(\"auth/%s/login\", c.config.JWTAuthBackendPath)\n\ts, err := cc.Logical().WriteWithContext(ctx, jwtLoginPath,\n\t\tmap[string]any{\n\t\t\t\"role\": req.Role,\n\t\t\t\"jwt\":  req.JWT,\n\t\t},\n\t)\n\tif err != nil {\n\t\treturn \"\", false, 0, fmt.Errorf(\"failed to login with JWT: %v\", err)\n\t}\n\tif s == nil {\n\t\treturn \"\", false, 0, errors.New(\"JWT login returned an empty secret\")\n\t}\n\tif s.Auth == nil {\n\t\treturn \"\", false, 0, errors.New(\"JWT login did not return a token\")\n\t}\n\n\tfor _, w := range s.Warnings {\n\t\tc.logger.Warn(\"JWT login warning\", \"warning\", w)\n\t}\n\n\treturn s.Auth.ClientToken, s.Auth.Renewable, s.Auth.LeaseDuration, nil\n}\n\nfunc (c *vaultClient) Renew(ctx context.Context, token string, lease int) (duration time.Duration, err error) {\n\tcc, err := c.Clone()\n\tif err != nil {","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/vaultclient/vaultclient.go#L141-L177","documentation":"DeriveTokenWithJWT wraps any error returned by Vault's JWT auth login (client.auth.JWT().Login) with this message. It means the Vault login call itself failed — the underlying error carries the real cause (network, 400/403, unknown role, etc.). The function derives a workload token by exchanging a JWT for a Vault secret.","triggerScenarios":"Calling DeriveTokenWithJWT when the Vault server is unreachable, the auth method/role 'req.Role' does not exist or mismatches the JWT, the JWT is expired/invalid, or the mount path is wrong — any non-nil error from the login call.","commonSituations":"Vault role renamed or deleted after agent config was written; expired workload JWT; Vault agent/auth mount disabled; TLS or network misconfiguration between Nomad client and Vault; wrong Vault address/namespace in config.","solutions":["Read the wrapped %v cause to identify the underlying failure (network vs auth rejection).","Verify the Vault JWT auth role name in the request matches a role configured on the Vault auth method.","Check that the JWT is valid and unexpired (decode it or test with 'vault write auth/jwt/login role=... jwt=...').","Verify Vault address, TLS, and namespace settings in the Nomad Vault config.","Confirm the JWT auth method is enabled at the expected mount path in Vault."],"exampleFix":"// before\nrole := \"old-role\" // removed in Vault\n// after\nrole := \"nomad-workloads\" // role that exists on the Vault jwt auth method","handlingStrategy":"try-catch","validationCode":"// before deriving: ensure inputs are sane\nif req.JWT == \"\" || req.Role == \"\" {\n    return fmt.Errorf(\"JWT and role are required before Vault login\")\n}","typeGuard":"func hasVaultAuth(s *api.Secret) bool { return s != nil && s.Auth != nil && s.Auth.ClientToken != \"\" }","tryCatchPattern":"token, _, _, err := vc.DeriveTokenWithJWT(req)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to login with JWT\") {\n        logger.Error(\"vault jwt login failed\", \"cause\", err, \"role\", req.Role)\n        // check role name, JWT expiry, Vault reachability before retrying\n    }\n    return err\n}","preventionTips":["Validate role name against Vault config before login","Check JWT expiry (exp claim) before deriving","Monitor Vault reachability/health endpoint","Pin Vault auth mount path and role names in config management"],"tags":["vault","jwt","authentication","nomad"],"backgroundTag":"jwt-login-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}