{"record":{"id":"4a835621b32ffa4e","repo":"hashicorp/nomad","slug":"missing-oidcdiscoveryurl","errorCode":null,"errorMessage":"missing OIDCDiscoveryURL","messagePattern":"missing OIDCDiscoveryURL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":1585,"sourceCode":"\t\t\ta.OIDCClientAssertion.Audience = []string{a.OIDCDiscoveryURL}\n\t\t}\n\t\t// the client assertion inherits the client secret,\n\t\t// in case KeySource = \"client_secret\"\n\t\ta.OIDCClientAssertion.ClientSecret = a.OIDCClientSecret\n\t\ta.OIDCClientAssertion.Canonicalize()\n\t}\n}\n\nfunc (a *ACLAuthMethodConfig) Validate(methodType string) error {\n\tif a == nil {\n\t\treturn errors.New(\"missing auth method Config\")\n\t}\n\tmErr := &multierror.Error{}\n\n\tswitch methodType {\n\tcase ACLAuthMethodTypeOIDC:\n\t\tif a.OIDCDiscoveryURL == \"\" {\n\t\t\tmErr = multierror.Append(mErr, errors.New(\"missing OIDCDiscoveryURL\"))\n\t\t}\n\t\tif a.OIDCClientID == \"\" {\n\t\t\tmErr = multierror.Append(mErr, errors.New(\"missing OIDCClientID\"))\n\t\t}\n\t\tif err := a.OIDCClientAssertion.Validate(); err != nil {\n\t\t\tmErr = multierror.Append(mErr, fmt.Errorf(\"invalid client assertion config: %w\", err))\n\t\t}\n\n\tcase ACLAuthMethodTypeJWT:\n\t\tif a.OIDCDiscoveryURL == \"\" && a.JWKSURL == \"\" && len(a.JWTValidationPubKeys) == 0 {\n\t\t\tmErr = multierror.Append(mErr, errors.New(\n\t\t\t\t\"JWT auth method requires either OIDCDiscoveryURL, or JWKS URL, or JWTValidationPubKeys set\"),\n\t\t\t)\n\t\t}\n\t}\n\n\treturn helper.FlattenMultierror(mErr)\n}","sourceCodeStart":1567,"sourceCodeEnd":1603,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L1567-L1603","documentation":"For OIDC auth methods, the discovery URL is mandatory: it tells Nomad where to fetch the provider's OpenID configuration. ACLAuthMethodConfig.Validate emits this error when methodType is OIDC but OIDCDiscoveryURL is empty.","triggerScenarios":"Upserting an auth method with Type \"oidc\" and Config lacking OIDCDiscoveryURL.","commonSituations":"Typos like discovery_url vs OIDCDiscoveryURL in API payloads; copying a JWT auth method config into an OIDC method; partially filled configs during terraform/CI provisioning.","solutions":["Set Config.OIDCDiscoveryURL to the provider's issuer/https discovery endpoint before submitting","Verify the method Type is OIDC and matches the config fields you supplied"],"exampleFix":"// before\ncfg := &api.ACLAuthMethodConfig{OIDCClientID: \"nomad\"}\n// after\ncfg := &api.ACLAuthMethodConfig{OIDCDiscoveryURL: \"https://accounts.google.com\", OIDCClientID: \"nomad\"}","handlingStrategy":"validation","validationCode":"func oidcConfigOK(c *structs.ACLAuthMethodConfig) bool {\n  return c != nil && c.OIDCDiscoveryURL != \"\" && c.OIDCClientID != \"\"\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify discovery URL is reachable (issuer/.well-known/openid-configuration) before registering","Check for empty template variables in CI"],"tags":["nomad","acl","oidc","validation"],"backgroundTag":"missing-oidc-discovery-url","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}