{"record":{"id":"50e41f1e91313b4b","repo":"hashicorp/nomad","slug":"invalid-client-assertion-config-w","errorCode":null,"errorMessage":"invalid client assertion config: %w","messagePattern":"invalid client assertion config: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":1591,"sourceCode":"\t}\n}\n\nfunc (a *ACLAuthMethodConfig) Validate(methodType string) error {\n\tif a == nil {\n\t\treturn errors.New(\"missing auth method Config\")\n\t}\n\tmErr := &multierror.Error{}\n\n\tswitch methodType {\n\tcase ACLAuthMethodTypeOIDC:\n\t\tif a.OIDCDiscoveryURL == \"\" {\n\t\t\tmErr = multierror.Append(mErr, errors.New(\"missing OIDCDiscoveryURL\"))\n\t\t}\n\t\tif a.OIDCClientID == \"\" {\n\t\t\tmErr = multierror.Append(mErr, errors.New(\"missing OIDCClientID\"))\n\t\t}\n\t\tif err := a.OIDCClientAssertion.Validate(); err != nil {\n\t\t\tmErr = multierror.Append(mErr, fmt.Errorf(\"invalid client assertion config: %w\", err))\n\t\t}\n\n\tcase ACLAuthMethodTypeJWT:\n\t\tif a.OIDCDiscoveryURL == \"\" && a.JWKSURL == \"\" && len(a.JWTValidationPubKeys) == 0 {\n\t\t\tmErr = multierror.Append(mErr, errors.New(\n\t\t\t\t\"JWT auth method requires either OIDCDiscoveryURL, or JWKS URL, or JWTValidationPubKeys set\"),\n\t\t\t)\n\t\t}\n\t}\n\n\treturn helper.FlattenMultierror(mErr)\n}\n\nfunc (a *ACLAuthMethodConfig) Copy() *ACLAuthMethodConfig {\n\tif a == nil {\n\t\treturn nil\n\t}\n","sourceCodeStart":1573,"sourceCodeEnd":1609,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L1573-L1609","documentation":"For Type=OIDC, ACLAuthMethod Config validation wraps any error from a.OIDCClientAssertion.Validate() as \"invalid client assertion config: %w\". The nested OIDCClientAssertion (private-key JWT client authentication) has a required field missing or malformed.","triggerScenarios":"Upserting an OIDC auth method whose Config.OIDCClientAssertion fails Validate() — e.g. missing KeySource/KeyFile/KeyID or ClientID components of the assertion — while relying on private-key JWT client auth to the IdP.","commonSituations":"Enabling client assertion for IdPs that require it (e.g. Azure AD with cert-based client auth) but leaving the signing key path or key ID unset; rotating keys and removing the referenced key file from config.","solutions":["Read the wrapped inner error and supply the missing assertion field (KeySource, KeyFile, KeyID, ClientID, etc.).","If private-key JWT is not needed, remove the OIDCClientAssertion block entirely so plain client-secret auth is used.","Verify the referenced key file exists on Nomad servers and is a parseable PEM/DER key.","Test the assertion config with the IdP docs' required claims before re-submitting."],"exampleFix":"// before\nConfig.OIDCClientAssertion = &structs.OIDCClientAssertion{ClientID: \"nomad\"}\n// after\nConfig.OIDCClientAssertion = &structs.OIDCClientAssertion{\n  ClientID:  \"nomad\",\n  KeySource: \"pem\",\n  KeyFile:   \"/etc/nomad/idp-signing-key.pem\",\n  KeyID:     \"key-2024-01\",\n}","handlingStrategy":"validation","validationCode":"if ca := am.Config.OIDCClientAssertion; ca != nil {\n\tif ca.ClientID == \"\" || ca.KeySource == \"\" || (ca.KeyFile == \"\" && ca.KeyPEM == \"\") {\n\t\treturn errors.New(\"client assertion needs ClientID, KeySource, and a key\")\n\t}\n\tif err := ca.Validate(); err != nil {\n\t\treturn err\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := am.Validate(minTTL, maxTTL); err != nil {\n\tif strings.Contains(err.Error(), \"invalid client assertion config\") {\n\t\t// inspect wrapped inner error for the exact assertion field\n\t}\n\treturn err\n}","preventionTips":["Only populate OIDCClientAssertion when your IdP requires private-key JWT auth","Verify key files exist and are readable on Nomad servers before deploy","Update KeyID/KeyFile together during key rotation"],"tags":["acl","oidc","validation","nomad"],"backgroundTag":"auth-method-config-missing","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}