{"record":{"id":"66de543c195d0665","repo":"hashicorp/nomad","slug":"computed-q-bind-name-for-bind-target-is-invalid","errorCode":null,"errorMessage":"computed %q bind name for bind target is invalid: %q","messagePattern":"computed %q bind name for bind target is invalid: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/binder.go","lineNumber":96,"sourceCode":"\t\t\tmatchingRules = append(matchingRules, rule)\n\t\t\tvlog.Debug(\"binding-rule selector matches an identity claim, will evaluate bind-name\", \"selector\", rule.Selector)\n\t\t} else {\n\t\t\tvlog.Debug(\"bind-rule selector did not match any claims\", \"selector\", rule.Selector)\n\t\t}\n\t}\n\tif len(matchingRules) == 0 {\n\t\treturn &bindings, nil\n\t}\n\n\t// Compute role or policy names by interpolating the identity's claim\n\t// mappings into the rule BindName templates.\n\tfor _, rule := range matchingRules {\n\t\tbindName, valid, err := computeBindName(rule.BindType, rule.BindName, identity.ClaimMappings)\n\t\tswitch {\n\t\tcase err != nil:\n\t\t\treturn nil, fmt.Errorf(\"cannot compute %q bind name for bind target: %w\", rule.BindType, err)\n\t\tcase !valid:\n\t\t\treturn nil, fmt.Errorf(\"computed %q bind name for bind target is invalid: %q\", rule.BindType, bindName)\n\t\t}\n\n\t\tswitch rule.BindType {\n\t\tcase structs.ACLBindingRuleBindTypeRole:\n\t\t\trole, err := b.store.GetACLRoleByName(nil, bindName)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\n\t\t\tif role != nil {\n\t\t\t\tbindings.Roles = append(bindings.Roles, &structs.ACLTokenRoleLink{\n\t\t\t\t\tID: role.ID,\n\t\t\t\t})\n\t\t\t\tvlog.Debug(\"role found with name matching ACL binding-rule\", \"name\", bindName)\n\t\t\t} else {\n\t\t\t\tvlog.Debug(\"no role found with name matching ACL binding-rule\", \"name\", bindName)\n\t\t\t}\n\t\tcase structs.ACLBindingRuleBindTypePolicy:","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/lib/auth/binder.go#L78-L114","documentation":"computeBindName successfully interpolated the bind name template, but the resulting string fails the name-validation regex for the rule's bind type (ValidPolicyName or ValidACLRoleName). Bind refuses to bind an invalid role/policy name rather than silently producing an unusable binding.","triggerScenarios":"Login where the interpolated result of a binding rule's BindName is empty or contains characters outside the allowed role/policy name character set (e.g. uppercase where lowercased value is required, spaces, '@', '/' with invalid placement).","commonSituations":"IdP claim value contains uppercase or special characters; HIL interpolation with lowercase=false-like path yields unexpected casing; claim value empty so computed name is \"\"; organization names from OIDC contain spaces or slashes.","solutions":["Inspect the quoted computed name in the error and compare with the allowed name regex","Sanitize or rename values at the IdP (e.g. use slugified group names)","Adjust the binding rule template (e.g. use a literal prefix or map to a different claim)","Create/verify the target ACL role or policy using exactly the computed name if it is actually valid but missing"],"exampleFix":"// before: claim yields \"Platform Engineering\"\nBindName: \"${team}\"\n// after: map to slug claim\nBindName: \"${team-slug}\" // e.g. \"platform-engineering\"","handlingStrategy":"validation","validationCode":"// check interpolated name against allowed charset before configuring the rule\nfunc nameIsValid(name string) bool {\n    re := regexp.MustCompile(`^[a-zA-Z0-9-_]{1,128}$`)\n    return re.MatchString(name)\n}","typeGuard":null,"tryCatchPattern":"bindings, err := binder.Bind(log, am, identity)\nif err != nil && strings.Contains(err.Error(), \"is invalid\") {\n    log.Warn(\"computed bind name failed name validation\", \"err\", err)\n    return nil, ErrInvalidComputedName\n}","preventionTips":["Slugify/sanitize IdP claim values (lowercase, replace spaces) before they feed bind names","Map to a dedicated slug claim instead of a human-readable name claim","Validate a sample of real claim values against the name regex during setup"],"tags":["auth","acl-binding-rule","name-validation"],"backgroundTag":"invalid-acl-name","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}