{"record":{"id":"52b70c2542ccaa9c","repo":"hashicorp/nomad","slug":"x5t-assertion-headers-use-sha-1-which-is-forbidde-52b70c","errorCode":null,"errorMessage":"x5t assertion headers use SHA-1, which is forbidden in FIPS-140 mode","messagePattern":"x5t assertion headers use SHA-1, which is forbidden in FIPS-140 mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":1901,"sourceCode":"\t\tif !path.IsAbs(k.PemCertFile) {\n\t\t\treturn fmt.Errorf(\"%w: must be absolute; got: %s\", ErrInvalidClientAssertionCertPath, k.PemCertFile)\n\t\t}\n\t}\n\n\t// only allow certain key id headers\n\t// only \"kid\" for KeyID\n\tif k.KeyID != \"\" && k.KeyIDHeader != OIDCClientAssertionHeaderKid {\n\t\treturn fmt.Errorf(\"%w; key header for key ID must be %q\",\n\t\t\tErrInvalidKeyIDHeader, OIDCClientAssertionHeaderKid)\n\t}\n\t// only \"x5t*\" for certs\n\tif k.PemCert != \"\" || k.PemCertFile != \"\" {\n\t\tif k.KeyIDHeader != OIDCClientAssertionHeaderX5t && k.KeyIDHeader != OIDCClientAssertionHeaderX5tS256 {\n\t\t\treturn fmt.Errorf(\"%w; certificate-derived key header must be one of: %q, %q\",\n\t\t\t\tErrInvalidKeyIDHeader, OIDCClientAssertionHeaderX5tS256, OIDCClientAssertionHeaderX5t)\n\t\t}\n\t\tif fips140.Enabled() && k.KeyIDHeader == OIDCClientAssertionHeaderX5t {\n\t\t\treturn errors.New(\"x5t assertion headers use SHA-1, which is forbidden in FIPS-140 mode\")\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// ACLAuthClaims is the claim mapping of the OIDC auth method in a format that\n// can be used with go-bexpr. This structure is used during rule binding\n// evaluation.\ntype ACLAuthClaims struct {\n\tValue map[string]string   `bexpr:\"value\"`\n\tList  map[string][]string `bexpr:\"list\"`\n}\n\n// ACLAuthMethodStub is used for listing ACL auth methods\ntype ACLAuthMethodStub struct {\n\tName    string\n\tType    string","sourceCodeStart":1883,"sourceCodeEnd":1919,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L1883-L1919","documentation":"The classic x5t header derives the key thumbprint with SHA-1, which Go's FIPS-140 module forbids. When running in FIPS-140 mode, Nomad rejects OIDC client assertions configured with KeyIDHeader \"x5t\" and requires the SHA-256 variant \"x5t#S256\" instead.","triggerScenarios":"Nomad built/run with FIPS-140 enabled (crypto/fips140.Enabled() true) and an OIDCClientAssertionKey has a cert (PemCert or PemCertFile) with KeyIDHeader == \"x5t\" during Validate().","commonSituations":"FedRAMP/FIPS-hardened deployments (often government) that copied an older auth-method config using x5t; migrating an existing OIDC setup onto a FIPS-enabled Nomad build.","solutions":["Switch KeyIDHeader to \"x5t#S256\" (OIDCClientAssertionHeaderX5tS256) and confirm your IdP accepts it","If the IdP only supports x5t (SHA-1), run Nomad without FIPS-140 mode enabled","Use a KeyID + \"kid\" header instead of a certificate-derived header if the IdP allows it"],"exampleFix":"// before\nkey := &structs.OIDCClientAssertionKey{\n  PemCertFile: \"/etc/nomad/tls/client.crt\",\n  KeyIDHeader: structs.OIDCClientAssertionHeaderX5t,\n}\n// after\nkey := &structs.OIDCClientAssertionKey{\n  PemCertFile: \"/etc/nomad/tls/client.crt\",\n  KeyIDHeader: structs.OIDCClientAssertionHeaderX5tS256,\n}","handlingStrategy":"validation","validationCode":"if fips140.Enabled() && key.KeyIDHeader == structs.OIDCClientAssertionHeaderX5t {\n    key.KeyIDHeader = structs.OIDCClientAssertionHeaderX5tS256\n}","typeGuard":null,"tryCatchPattern":"if err := key.Validate(); err != nil {\n    if strings.Contains(err.Error(), \"forbidden in FIPS-140 mode\") {\n        // switch header to x5t#S256 or disable FIPS mode\n    }\n    return err\n}","preventionTips":["In FIPS deployments, standardize on x5t#S256 or kid headers","Confirm IdP support for x5t#S256 before enabling FIPS mode","Add a config lint step that flags x5t when FIPS builds are targeted"],"tags":["nomad","fips","sha-1","oidc","compliance"],"backgroundTag":"fips-forbidden-algorithm","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}