{"record":{"id":"42b41cf1b4c1c8d5","repo":"hashicorp/nomad","slug":"missing-oidcclientid","errorCode":null,"errorMessage":"missing OIDCClientID","messagePattern":"missing OIDCClientID","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":1588,"sourceCode":"\t\t// in case KeySource = \"client_secret\"\n\t\ta.OIDCClientAssertion.ClientSecret = a.OIDCClientSecret\n\t\ta.OIDCClientAssertion.Canonicalize()\n\t}\n}\n\nfunc (a *ACLAuthMethodConfig) Validate(methodType string) error {\n\tif a == nil {\n\t\treturn errors.New(\"missing auth method Config\")\n\t}\n\tmErr := &multierror.Error{}\n\n\tswitch methodType {\n\tcase ACLAuthMethodTypeOIDC:\n\t\tif a.OIDCDiscoveryURL == \"\" {\n\t\t\tmErr = multierror.Append(mErr, errors.New(\"missing OIDCDiscoveryURL\"))\n\t\t}\n\t\tif a.OIDCClientID == \"\" {\n\t\t\tmErr = multierror.Append(mErr, errors.New(\"missing OIDCClientID\"))\n\t\t}\n\t\tif err := a.OIDCClientAssertion.Validate(); err != nil {\n\t\t\tmErr = multierror.Append(mErr, fmt.Errorf(\"invalid client assertion config: %w\", err))\n\t\t}\n\n\tcase ACLAuthMethodTypeJWT:\n\t\tif a.OIDCDiscoveryURL == \"\" && a.JWKSURL == \"\" && len(a.JWTValidationPubKeys) == 0 {\n\t\t\tmErr = multierror.Append(mErr, errors.New(\n\t\t\t\t\"JWT auth method requires either OIDCDiscoveryURL, or JWKS URL, or JWTValidationPubKeys set\"),\n\t\t\t)\n\t\t}\n\t}\n\n\treturn helper.FlattenMultierror(mErr)\n}\n\nfunc (a *ACLAuthMethodConfig) Copy() *ACLAuthMethodConfig {\n\tif a == nil {","sourceCodeStart":1570,"sourceCodeEnd":1606,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L1570-L1606","documentation":"Appended by ACLAuthMethodConfig.Validate when the auth method type is OIDC but OIDCClientID is empty; the OIDC flow cannot start without a client ID registered with the identity provider.","triggerScenarios":"Upserting an auth method with Type \"oidc\" whose Config.OIDCClientID is unset/empty.","commonSituations":"Provider registration done later than Nomad config; copied configs from JWT methods which don't need a client ID; template variables that render to empty string (e.g. unset TF var).","solutions":["Set Config.OIDCClientID to the client ID registered with the OIDC provider","Confirm the provider application is created and copy its client ID","Check templating/CI variables actually interpolate a non-empty value"],"exampleFix":"// before\nConfig: &api.ACLAuthMethodConfig{OIDCDiscoveryURL: discoveryURL}\n// after\nConfig: &api.ACLAuthMethodConfig{OIDCDiscoveryURL: discoveryURL, OIDCClientID: \"nomad-ui\"}","handlingStrategy":"validation","validationCode":"func clientIDOK(c *structs.ACLAuthMethodConfig) bool {\n  return c != nil && c.OIDCClientID != \"\"\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Register the Nomad client with the IdP first and store the client ID","Assert non-empty interpolated values in provisioning code"],"tags":["nomad","acl","oidc","validation"],"backgroundTag":"missing-oidc-client-id","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}