{"record":{"id":"381c3a2ba85c0487","repo":"hashicorp/nomad","slug":"failed-to-retrieve-the-id-token-claims-v","errorCode":null,"errorMessage":"failed to retrieve the ID token claims: %v","messagePattern":"failed to retrieve the ID token claims: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/acl_endpoint.go","lineNumber":2808,"sourceCode":"\t}\n\n\t// Generate a context with a deadline. This is passed to the OIDC provider\n\t// and used when making remote HTTP requests.\n\tctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(aclOIDCCallbackRequestExpiryTime))\n\tdefer cancel()\n\n\t// Exchange the state and code for an OIDC provider token.\n\toidcToken, err := oidcProvider.Exchange(ctx, oidcReq, args.State, args.Code)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to exchange token with provider: %v\", err)\n\t}\n\tif !oidcToken.Valid() {\n\t\treturn errors.New(\"exchanged token is not valid; potentially expired or empty\")\n\t}\n\n\tvar idTokenClaims map[string]any\n\tif err := oidcToken.IDToken().Claims(&idTokenClaims); err != nil {\n\t\treturn fmt.Errorf(\"failed to retrieve the ID token claims: %v\", err)\n\t}\n\n\tvar userClaims map[string]any\n\tif !authMethod.Config.OIDCDisableUserInfo {\n\t\tif userTokenSource := oidcToken.StaticTokenSource(); userTokenSource != nil {\n\t\t\tif err := oidcProvider.UserInfo(ctx, userTokenSource, idTokenClaims[\"sub\"].(string), &userClaims); err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to retrieve the user info claims: %v\", err)\n\t\t\t}\n\t\t}\n\t}\n\n\t// Generate the data used by the go-bexpr selector that is an internal\n\t// representation of the claims that can be understood by Nomad.\n\toidcInternalClaims, err := auth.SelectorData(authMethod, idTokenClaims, userClaims)\n\tif err != nil {\n\t\treturn err\n\t}\n","sourceCodeStart":2790,"sourceCodeEnd":2826,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/acl_endpoint.go#L2790-L2826","documentation":"Thrown when oidcToken.IDToken().Claims(&idTokenClaims) fails to JSON-decode the ID token payload into map[string]any. This means the token came back but its ID-token claims could not be parsed — typically a malformed or unexpectedly-encoded ID token from the provider.","triggerScenarios":"OIDCCompleteAuth calls IDToken().Claims() on the token returned by Exchange and the cap library returns a decode error (malformed JWT payload, non-object claims).","commonSituations":"Misbehaving or non-standard IdP returning an ID token whose claims are not a JSON object, corrupted token from a proxy, provider returning an opaque token where an ID token is expected.","solutions":["Inspect the raw ID token (jwt.io) returned by the provider for a non-standard claims payload.","Upgrade Nomad / the cap library — parsing bugs are fixed upstream.","Check for a reverse proxy or security appliance mangling the token response body.","Switch to a standards-compliant provider configuration or open an issue with the provider vendor."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// decode the ID token client-side first to sanity-check claims\nparts := strings.Split(rawIDToken, \".\")\nif len(parts) != 3 { return errors.New(\"not a JWT\") }\npayload, _ := base64.RawURLEncoding.DecodeString(parts[1])\nvar claims map[string]any\nif err := json.Unmarshal(payload, &claims); err != nil { return err }\nif _, ok := claims[\"sub\"]; !ok { return errors.New(\"missing sub\") }","typeGuard":null,"tryCatchPattern":"if err := oidcToken.IDToken().Claims(&idTokenClaims); err != nil {\n    return fmt.Errorf(\"failed to retrieve the ID token claims: %v\", err)\n}","preventionTips":["Prefer well-known, standards-compliant IdPs.","Inspect raw tokens with a JWT decoder when introducing a new provider.","Keep Nomad and its cap dependency updated for parser fixes."],"tags":["oidc","jwt","claims","nomad"],"backgroundTag":"jwt-claims-decode-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}