{"record":{"id":"2325e8ac53bad809","repo":"hashicorp/nomad","slug":"auth-method-is-missing","errorCode":null,"errorMessage":"auth method is missing","messagePattern":"auth method is missing","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":2087,"sourceCode":"\t// therefore we need to generate base information.\n\tif a.ID == \"\" {\n\t\ta.ID = uuid.Generate()\n\t\ta.CreateTime = now\n\t}\n\n\t// The fact this function is being called indicates we are attempting an\n\t// upsert into state. Therefore, update the modify time.\n\ta.ModifyTime = now\n}\n\n// Validate ensures the ACL binding rule contains valid information which meets\n// Nomad's internal requirements.\nfunc (a *ACLBindingRule) Validate() error {\n\n\tvar mErr multierror.Error\n\n\tif a.AuthMethod == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"auth method is missing\"))\n\t}\n\tif len(a.Description) > maxACLBindingRuleDescriptionLength {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"description longer than %d\", maxACLRoleDescriptionLength))\n\t}\n\n\t// Depending on the bind type, we have some specific validation. Catching\n\t// the empty string also provides easier to understand feedback to the\n\t// user.\n\tswitch a.BindType {\n\tcase \"\":\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"bind type is missing\"))\n\tcase ACLBindingRuleBindTypeRole, ACLBindingRuleBindTypePolicy:\n\t\tif a.BindName == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, errors.New(\"bind name is missing\"))\n\t\t}\n\tcase ACLBindingRuleBindTypeManagement:\n\t\tif a.BindName != \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, errors.New(\"bind name should be empty\"))","sourceCodeStart":2069,"sourceCodeEnd":2105,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L2069-L2105","documentation":"An ACLBindingRule must reference the ACL auth method it belongs to. ACLBindingRule.Validate() appends this error to its multierror when AuthMethod is the empty string, because a binding rule without an auth method can never be evaluated during login.","triggerScenarios":"Creating or updating a binding rule via the ACL API/CLI/nomad acl binding-rule create with no AuthMethod field set.","commonSituations":"Hand-written JSON payloads omitting auth_method; SDK usage constructing ACLBindingRule structs directly; CLI flags forgotten (e.g. missing -method); imports from other systems where the field was named differently.","solutions":["Set AuthMethod to the name of an existing ACL auth method before submitting","Create the auth method first (nomad acl auth-method create) then reference its exact name","Check CLI/API payloads include auth_method"],"exampleFix":"// before\nrule := &structs.ACLBindingRule{\n  BindType: structs.ACLBindingRuleBindTypePolicy,\n  BindName: \"eng-dev\",\n}\n// after\nrule := &structs.ACLBindingRule{\n  AuthMethod: \"okoidc\",\n  BindType: structs.ACLBindingRuleBindTypePolicy,\n  BindName: \"eng-dev\",\n}","handlingStrategy":"validation","validationCode":"if rule.AuthMethod == \"\" {\n    return errors.New(\"binding rule requires AuthMethod\")\n}\nif err := rule.Validate(); err != nil { return err }","typeGuard":null,"tryCatchPattern":"if err := rule.Validate(); err != nil {\n    if strings.Contains(err.Error(), \"auth method is missing\") {\n        // populate rule.AuthMethod and resubmit\n    }\n    return err\n}","preventionTips":["Create the auth method before its binding rules","Always set AuthMethod in SDK-constructed ACLBindingRule structs","Run Validate() client-side before hitting the API"],"tags":["nomad","acl","binding-rule","config-validation"],"backgroundTag":"missing-required-argument","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}