{"record":{"id":"2778c51e00507cbe","repo":"hashicorp/nomad","slug":"failed-to-create-oidc-request-v","errorCode":null,"errorMessage":"failed to create OIDC request: %v","messagePattern":"failed to create OIDC request: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/acl_endpoint.go","lineNumber":3155,"sourceCode":"\t\t}\n\t\topts = append(opts, capOIDC.WithPKCE(verifier))\n\t}\n\n\tif config.OIDCClientAssertion.IsSet() {\n\t\tj, err := a.oidcClientAssertion(config)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\topts = append(opts, capOIDC.WithClientAssertionJWT(j))\n\t}\n\n\treq, err := capOIDC.NewRequest(\n\t\taclOIDCAuthURLRequestExpiryTime,\n\t\tredirect,\n\t\topts...,\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create OIDC request: %v\", err)\n\t}\n\n\treturn req, nil\n}\n\nfunc (a *ACL) oidcClientAssertion(config *structs.ACLAuthMethodConfig) (*cass.JWT, error) {\n\t// this nomad key will only actually be used if the client assertion config\n\t// KeySource = \"nomad\", but we get it here to avoid exposing more of the\n\t// codebase to the encrypter.\n\tnomadKey, nomadKID, err := a.srv.encrypter.GetActiveKey()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get active nomad key: %w\", err)\n\t}\n\tj, err := oidc.BuildClientAssertionJWT(config, nomadKey, nomadKID)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to build client_assertion jwt: %w\", err)\n\t}\n\tif config.VerboseLogging {","sourceCodeStart":3137,"sourceCodeEnd":3173,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/acl_endpoint.go#L3137-L3173","documentation":"Thrown by oidcRequest when capOIDC.NewRequest fails to construct the OIDC auth request object that carries the expiry, redirect URI, and options (scopes, audiences, PKCE verifier, client assertion). The wrapped error explains which option or parameter the cap library rejected.","triggerScenarios":"capOIDC.NewRequest(aclOIDCAuthURLRequestExpiryTime, redirect, opts...) returns an error: invalid redirect URI format, invalid expiry, or one of the accumulated opts (audiences, scopes, PKCE verifier, client assertion JWT) is malformed.","commonSituations":"Misconfigured AllowedRedirectURIs producing a bad redirect value, invalid BoundAudiences or OIDCScopes entries, a client assertion JWT built with bad key material passed via WithClientAssertion.","solutions":["Read the wrapped cause to see which parameter cap rejected.","Verify AllowedRedirectURIs in the auth method config are absolute, well-formed URLs and match the callback exactly.","Check BoundAudiences, OIDCScopes, and OIDCClientAssertion fields for empty/malformed values.","Upgrade Nomad / cap library if the error stems from a cap validation bug."],"exampleFix":"// before\n\"AllowedRedirectURIs\": [\"ui/oidc/callback\"]\n// after\n\"AllowedRedirectURIs\": [\"https://nomad.example.com/ui/oidc/callback\",\"https://nomad.example.com/oauth2/oidc/callback\"]","handlingStrategy":"validation","validationCode":"// validate auth-method config before calling the auth URL endpoint\nu, err := url.Parse(method.Config.AllowedRedirectURIs[0])\nif err != nil || !u.IsAbs() { return errors.New(\"redirect URI must be absolute\") }\nif len(method.Config.BoundAudiences) == 0 && len(method.Config.BoundClaims) == 0 {\n  return errors.New(\"need BoundAudiences or BoundClaims\")\n}","typeGuard":null,"tryCatchPattern":"req, err := capOIDC.NewRequest(expiry, redirect, opts...)\nif err != nil {\n    return nil, fmt.Errorf(\"failed to create OIDC request: %v\", err)\n}","preventionTips":["Keep AllowedRedirectURIs absolute and exact (scheme+host+path).","Validate BoundAudiences/Scopes for typos when saving auth methods.","Re-validate config after IdP-side changes (redirect registrations)."],"tags":["oidc","request-validation","nomad","config"],"backgroundTag":"oidc-request-invalid","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}