{"record":{"id":"03588caf45b9162a","repo":"hashicorp/nomad","slug":"failed-to-generate-auth-url-v","errorCode":null,"errorMessage":"failed to generate auth URL: %v","messagePattern":"failed to generate auth URL: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/acl_endpoint.go","lineNumber":2690,"sourceCode":"\t}\n\n\t// Use the cache to provide us with an OIDC provider for the auth method\n\t// that was resolved from state.\n\toidcProvider, err := a.oidcProviderCache.Get(authMethod)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to generate OIDC provider: %v\", err)\n\t}\n\n\t// Generate a context. This argument is required by the OIDC provider lib,\n\t// but is not used in any way. This therefore acts for future proofing, if\n\t// the provider lib uses the context.\n\tctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(aclOIDCAuthURLRequestExpiryTime))\n\tdefer cancel()\n\n\t// Generate the URL, handling any error along with the URL.\n\tauthURL, err := oidcProvider.AuthURL(ctx, oidcReq)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to generate auth URL: %v\", err)\n\t}\n\n\treply.AuthURL = authURL\n\treturn nil\n}\n\n// OIDCCompleteAuth complete the OIDC login workflow. It will exchange the OIDC\n// provider token for a Nomad ACL token, using the configured ACL role and\n// policy claims to provide authorization.\nfunc (a *ACL) OIDCCompleteAuth(\n\targs *structs.ACLOIDCCompleteAuthRequest, reply *structs.ACLLoginResponse) error {\n\n\t// The OIDC flow can only be used when the Nomad cluster has ACL enabled.\n\tif !a.srv.config.ACLEnabled {\n\t\treturn aclDisabled\n\t}\n\n\t// Perform the initial forwarding within the region. This ensures we","sourceCodeStart":2672,"sourceCodeEnd":2708,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/acl_endpoint.go#L2672-L2708","documentation":"After successfully constructing the OIDC provider, OIDCAuthURL asks it to build the authorization-endpoint redirect URL for the request. If the provider library rejects the request parameters (invalid scope, bad redirect URI, malformed audience/claims), the error is wrapped as 'failed to generate auth URL'.","triggerScenarios":"Calling OIDCAuthURL with a login request whose RedirectURI is not a valid/allowed URL, whose scopes or audiences conflict with the auth method config, or where the provider's discovery data cannot support the requested parameters.","commonSituations":"Redirect URI not registered with the IdP; requesting scopes the auth method doesn't allow (SignEphemeral, extra scopes); misconfigured OIDCEndpointAuthParams; wrong client configuration after an IdP change.","solutions":["Check the wrapped error for the exact parameter the IdP/library rejected.","Fix the auth method's AllowedRedirectURIs and retry with a matching RedirectURI in the login request.","Validate requested Scopes/Audiences against the auth method config (TokenLocality, BoundAudiences, AllowedClaims).","Update the IdP application registration to accept Nomad's redirect URI."],"exampleFix":"// before (redirect URI not allowed)\nresp, _, err := client.ACL().GetOIDCAuthURL(&api.ACLLoginRequest{AuthMethodName: \"okta\", RedirectURI: \"http://localhost:9999\"}, nil)\n// -> failed to generate auth URL: ...\n// after (register and use an allowed URI)\nresp, _, err := client.ACL().GetOIDCAuthURL(&api.ACLLoginRequest{AuthMethodName: \"okta\", RedirectURI: \"http://localhost:9250/oidc/callback\"}, nil)","handlingStrategy":"validation","validationCode":"// ensure the redirect URI is registered on the auth method and the IdP app\nam, _, err := client.ACL().GetAuthMethod(\"okta\", nil)\nif err != nil { return err }\nallowed := map[string]bool{}\nfor _, u := range am.Config.AllowedRedirectURIs { allowed[u] = true }\nif !allowed[req.RedirectURI] { return fmt.Errorf(\"redirect URI %q not in AllowedRedirectURIs\", req.RedirectURI) }","typeGuard":"func redirectURIAllowed(allowed []string, uri string) bool { for _, a := range allowed { if a == uri { return true } }; return false }","tryCatchPattern":"_, _, err := client.ACL().GetOIDCAuthURL(req, nil)\nif err != nil && strings.Contains(err.Error(), \"failed to generate auth URL\") {\n    return fmt.Errorf(\"check RedirectURI/scopes/audiences vs auth method config: %w\", err)\n}","preventionTips":["Register the exact redirect URI both in AllowedRedirectURIs and in the IdP application","Only request scopes permitted by the auth method config","Match BoundAudiences/OIDCClientID to the IdP client credentials","Test 'nomad login' after every auth-method change"],"tags":["nomad","acl","oidc","sso","redirect-uri"],"backgroundTag":"oidc-auth-url-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}