{"record":{"id":"0eb90102a812fbd6","repo":"hashicorp/nomad","slug":"invalid-keysource-q","errorCode":null,"errorMessage":"invalid KeySource %q","messagePattern":"invalid KeySource %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":1788,"sourceCode":"\t}\n\tif len(c.Audience) == 0 || c.Audience[0] == \"\" {\n\t\treturn errors.New(\"missing Audience\")\n\t}\n\tswitch c.KeySource {\n\tcase OIDCKeySourceNomad:\n\tcase OIDCKeySourcePrivateKey:\n\t\tif c.PrivateKey == nil {\n\t\t\treturn errors.New(\"PrivateKey is required for `private_key` KeySource\")\n\t\t}\n\t\tif err := c.PrivateKey.Validate(); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid PrivateKey: %w\", err)\n\t\t}\n\tcase OIDCKeySourceClientSecret:\n\t\tif c.ClientSecret == \"\" {\n\t\t\treturn errors.New(\"OIDCClientSecret is required for `client_secret` KeySource\")\n\t\t}\n\tdefault:\n\t\treturn fmt.Errorf(\"invalid KeySource %q\", c.KeySource)\n\t}\n\treturn nil\n}\n\ntype OIDCClientAssertionKeyIDHeader string\n\nconst (\n\tOIDCClientAssertionHeaderKid     OIDCClientAssertionKeyIDHeader = \"kid\"\n\tOIDCClientAssertionHeaderX5t     OIDCClientAssertionKeyIDHeader = \"x5t\"\n\tOIDCClientAssertionHeaderX5tS256 OIDCClientAssertionKeyIDHeader = \"x5t#S256\"\n)\n\n// OIDCClientAssertionKey contains key material provided by users for Nomad\n// to use to sign the private key JWT.\n// See api.OIDCClientAssertionKey for full field descriptions.\ntype OIDCClientAssertionKey struct {\n\tPemKey     string\n\tPemKeyFile string","sourceCodeStart":1770,"sourceCodeEnd":1806,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L1770-L1806","documentation":"Returned when validating an OIDC client assertion whose KeySource is not one of the supported enum values (e.g. nomad, private_key, client_secret). The default branch of the KeySource switch rejects any unrecognized string. It means the `key_source` field holds a typo or unsupported value.","triggerScenarios":"Creating/updating an OIDC provider auth method with OIDCClientAssertion.KeySource set to anything outside the defined OIDCKeySource* constants, such as \"keys\", \"jwt\", \"\" (empty), or a mis-cased \"Private_Key\".","commonSituations":"Typo in key_source value; copying config from Vault or another OIDC integration that uses different KeySource names; upgrading Nomad and using a value not yet supported.","solutions":["Set key_source to one of the supported values: \"nomad\", \"private_key\", or \"client_secret\".","Check spelling and lowercase casing of the value.","Confirm your Nomad version supports the chosen KeySource (nomad version / docs)."],"exampleFix":"// before\nkey_source = \"privte_key\"\n\n// after\nkey_source = \"private_key\"","handlingStrategy":"validation","validationCode":"var validKeySources = map[string]bool{\"nomad\": true, \"private_key\": true, \"client_secret\": true}\nif !validKeySources[assertion.KeySource] {\n    return fmt.Errorf(\"key_source %q not supported; use nomad, private_key, or client_secret\", assertion.KeySource)\n}","typeGuard":"func isValidKeySource(s string) bool {\n    switch s {\n    case \"nomad\", \"private_key\", \"client_secret\":\n        return true\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Keep a constant list of allowed key_source values in your IaC code.","Validate enum fields with a schema (e.g. JSON Schema enum) pre-submit."],"tags":["nomad","acl","oidc","enum-value","validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}