{"record":{"id":"3645d8952728b0e9","repo":"hashicorp/nomad","slug":"default-auth-config-text-could-not-be-deserialized","errorCode":null,"errorMessage":"default auth config text could not be deserialized: %v","messagePattern":"default auth config text could not be deserialized: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/setup_consul.go","lineNumber":430,"sourceCode":"\nfunc (s *SetupConsulCommand) authMethodExists(authMethodName string) bool {\n\tqo := &api.QueryOptions{}\n\tif s.consulEnt {\n\t\t// auth methods are created in the default ns\n\t\tqo.Namespace = \"default\"\n\t}\n\n\texistingMethods, _, _ := s.client.ACL().AuthMethodList(qo)\n\treturn slices.ContainsFunc(\n\t\texistingMethods,\n\t\tfunc(m *api.ACLAuthMethodListEntry) bool { return m.Name == authMethodName })\n}\n\nfunc (s *SetupConsulCommand) renderAuthMethod(name string, desc string) (*api.ACLAuthMethod, error) {\n\tauthConfig := map[string]any{}\n\terr := json.Unmarshal(consulAuthConfigBody, &authConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"default auth config text could not be deserialized: %v\", err)\n\t}\n\n\tauthConfig[\"JWKSURL\"] = s.jwksURL\n\tauthConfig[\"BoundAudiences\"] = []string{consulAud}\n\tauthConfig[\"JWTSupportedAlgs\"] = []string{\"RS256\"}\n\n\tif s.jwksCACertPath != \"\" {\n\t\tcaCert, err := os.ReadFile(s.jwksCACertPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not read -jwks-certfile: %v\", err)\n\t\t}\n\t\tauthConfig[\"JWKSCACert\"] = string(caCert)\n\t}\n\n\tmethod := &api.ACLAuthMethod{\n\t\tName:          name,\n\t\tType:          \"jwt\",\n\t\tDisplayName:   name,","sourceCodeStart":412,"sourceCodeEnd":448,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/setup_consul.go#L412-L448","documentation":"In `nomad setup consul`, renderAuthMethod unmarshals an embedded default JSON template (consulAuthConfigBody) into a map to build the JWT auth method. If the embedded constant is not valid JSON, this error wraps the json.Unmarshal failure. Since the template ships with the binary, this almost always indicates a corrupted or locally modified build.","triggerScenarios":"json.Unmarshal(consulAuthConfigBody, &authConfig) fails — the compiled-in auth config JSON is malformed, typically after a source modification, bad merge, or build from an incomplete/corrupted checkout.","commonSituations":"Building Nomad from a fork or patched source where command/setup_consul.go's embedded JSON was edited and broke syntax; vendoring tools or code generators corrupting string constants; a bad merge conflict resolution leaving partial JSON in the constant.","solutions":["Rebuild from a pristine upstream checkout: `git checkout -- command/setup_consul.go && make build` (or re-download the official release binary).","Verify the binary isn't modified: compare checksum against the official release for your version.","If you intentionally customized consulAuthConfigBody, validate the JSON: `echo '<your json>' | jq .` and fix syntax errors.","Work around by configuring the Consul auth method manually via `consul acl auth-method create` with your own -config instead of running nomad setup."],"exampleFix":"// before (corrupted embedded constant)\nconst consulAuthConfigBody = `{\"JWTSupportedAlgs\": [\"RS256\",,]}`\n// after\nconst consulAuthConfigBody = `{\"JWTSupportedAlgs\": [\"RS256\"]}`","handlingStrategy":"type-guard","validationCode":"// validate the embedded template before use\nif !json.Valid([]byte(consulAuthConfigBody)) {\n    return fmt.Errorf(\"consulAuthConfigBody is not valid JSON\")\n}","typeGuard":"func validJSONObject(b []byte) bool {\n    var m map[string]any\n    return json.Unmarshal(b, &m) == nil && m != nil\n}","tryCatchPattern":"authConfig := map[string]any{}\nif err := json.Unmarshal(consulAuthConfigBody, &authConfig); err != nil {\n    return fmt.Errorf(\"default auth config text could not be deserialized: %v\", err)\n}","preventionTips":["Don't hand-edit embedded JSON constants without validating with jq or a linter.","Build from a clean upstream checkout; verify release binary checksums.","Add a unit test asserting json.Valid(consulAuthConfigBody) in CI.","Resolve merge conflicts in *_body string constants carefully and re-validate."],"tags":["consul","json","setup","cli"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}