{"record":{"id":"459acab3563fbd2e","repo":"hashicorp/nomad","slug":"invalid-token-type-s","errorCode":null,"errorMessage":"invalid token type '%s'","messagePattern":"invalid token type '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":1440,"sourceCode":"\n// Validate returns an error is the ACLAuthMethod is invalid.\n//\n// TODO revisit possible other validity conditions in the future\nfunc (a *ACLAuthMethod) Validate(minTTL, maxTTL time.Duration) error {\n\tvar mErr multierror.Error\n\n\tif !ValidACLAuthMethod.MatchString(a.Name) {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"invalid name '%s'\", a.Name))\n\t}\n\n\tif !slices.Contains([]string{ACLAuthMethodTokenLocalityLocal, ACLAuthMethodTokenLocalityGlobal}, a.TokenLocality) {\n\t\tmErr.Errors = append(\n\t\t\tmErr.Errors, fmt.Errorf(\"invalid token locality '%s'\", a.TokenLocality))\n\t}\n\n\tif !slices.Contains(ValidACLAuthMethodTypes, a.Type) {\n\t\tmErr.Errors = append(\n\t\t\tmErr.Errors, fmt.Errorf(\"invalid token type '%s'\", a.Type))\n\t}\n\n\tif err := a.Config.Validate(a.Type); err != nil {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"invalid config: %w\", err))\n\t}\n\n\tif minTTL > a.MaxTokenTTL || a.MaxTokenTTL > maxTTL {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\n\t\t\t\"invalid MaxTokenTTL value '%s' (should be between %s and %s)\",\n\t\t\ta.MaxTokenTTL.String(), minTTL.String(), maxTTL.String()))\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\n// Sanitize returns a copy of the ACLAuthMethod with any secrets redacted\nfunc (a *ACLAuthMethod) Sanitize() *ACLAuthMethod {\n\tif a == nil || a.Config == nil {","sourceCodeStart":1422,"sourceCodeEnd":1458,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L1422-L1458","documentation":"ACLAuthMethod.Validate() rejects Type because it is not in ValidACLAuthMethodTypes, which currently contains only \"OIDC\" and \"JWT\". Nomad only ships built-in support for these two auth method protocols.","triggerScenarios":"Creating an auth method with Type like \"jwt\", \"oidc\", \"HMAC\", \"SAML\", or an empty string. The comparison is exact/uppercase-sensitive.","commonSituations":"Writing the type in lowercase in HCL/JSON config; assuming other HashiCorp-style types (e.g. Consul's 'jwt' providers) are supported; typos like 'OIDCS'.","solutions":["Set Type to exactly \"OIDC\" or \"JWT\".","Use constants structs.ACLAuthMethodTypeOIDC / ACLAuthMethodTypeJWT instead of literals.","Check the Nomad version's ValidACLAuthMethodTypes if a newer type was expected; upgrade Nomad if needed."],"exampleFix":"// before\nam := &structs.ACLAuthMethod{Name: \"okta\", Type: \"oidc\"}\n// after\nam := &structs.ACLAuthMethod{Name: \"okta\", Type: structs.ACLAuthMethodTypeOIDC}","handlingStrategy":"validation","validationCode":"if !slices.Contains([]string{\"OIDC\",\"JWT\"}, am.Type) {\n\treturn fmt.Errorf(\"Type must be OIDC or JWT, got %q\", am.Type)\n}","typeGuard":"func validAuthMethodType(t string) bool { return t == \"OIDC\" || t == \"JWT\" }","tryCatchPattern":"if err := am.Validate(minTTL, maxTTL); err != nil {\n\tif strings.Contains(err.Error(), \"invalid token type\") {\n\t\treturn fmt.Errorf(\"check Type casing; supported: OIDC, JWT\")\n\t}\n\treturn err\n}","preventionTips":["Type strings are uppercase: 'OIDC', 'JWT' — never 'oidc'/'jwt'","Use structs.ACLAuthMethodTypeOIDC / ACLAuthMethodTypeJWT constants","Check ValidACLAuthMethodTypes in your Nomad version before adopting new types"],"tags":["acl","validation","nomad"],"backgroundTag":"invalid-enum-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}