{"record":{"id":"6f343cb9cfd09776","repo":"hashicorp/nomad","slug":"missing-audience","errorCode":null,"errorMessage":"missing Audience","messagePattern":"missing Audience","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":1772,"sourceCode":"\t\tcase OIDCKeySourceClientSecret:\n\t\t\tc.KeyAlgorithm = \"HS256\"\n\t\tcase OIDCKeySourceNomad, OIDCKeySourcePrivateKey:\n\t\t\tc.KeyAlgorithm = \"RS256\"\n\t\t}\n\t}\n\tc.PrivateKey.Canonicalize()\n}\n\nfunc (c *OIDCClientAssertion) IsSet() bool {\n\treturn c != nil && c.KeySource != \"\"\n}\n\nfunc (c *OIDCClientAssertion) Validate() error {\n\tif c == nil {\n\t\treturn nil\n\t}\n\tif len(c.Audience) == 0 || c.Audience[0] == \"\" {\n\t\treturn errors.New(\"missing Audience\")\n\t}\n\tswitch c.KeySource {\n\tcase OIDCKeySourceNomad:\n\tcase OIDCKeySourcePrivateKey:\n\t\tif c.PrivateKey == nil {\n\t\t\treturn errors.New(\"PrivateKey is required for `private_key` KeySource\")\n\t\t}\n\t\tif err := c.PrivateKey.Validate(); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid PrivateKey: %w\", err)\n\t\t}\n\tcase OIDCKeySourceClientSecret:\n\t\tif c.ClientSecret == \"\" {\n\t\t\treturn errors.New(\"OIDCClientSecret is required for `client_secret` KeySource\")\n\t\t}\n\tdefault:\n\t\treturn fmt.Errorf(\"invalid KeySource %q\", c.KeySource)\n\t}\n\treturn nil","sourceCodeStart":1754,"sourceCodeEnd":1790,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L1754-L1790","documentation":"When an OIDC client assertion is configured, its Audience list must be non-empty and the first entry non-blank — the audience identifies the intended token recipient (the IdP token endpoint). OIDCClientAssertion.Validate returns this error otherwise.","triggerScenarios":"Setting Config.OIDCClientAssertion without Audience, with an empty list, or with [\"\"] as the first element, then upserting the auth method or using private_key_jwt authentication.","commonSituations":"Partial private_key_jwt setups where key material is configured but the required audience (usually the issuer or token endpoint URL) is omitted; copy-pasted assertion blocks with placeholder audience removed.","solutions":["Set Audience to at least one value, typically the OIDC issuer or token endpoint URL the IdP expects","Ensure the first audience element is a non-empty string"],"exampleFix":"// before\nassertion := &api.OIDCClientAssertion{KeySource: \"nomad\"}\n// after\nassertion := &api.OIDCClientAssertion{KeySource: \"nomad\", Audience: [\"https://issuer.example.com\"]}","handlingStrategy":"validation","validationCode":"func assertionAudienceOK(c *structs.OIDCClientAssertion) bool {\n  return c == nil || (len(c.Audience) > 0 && c.Audience[0] != \"\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set audience to the IdP token endpoint/issuer","Check first element is non-empty after templating"],"tags":["nomad","oidc","jwt","validation"],"backgroundTag":"jwt-audience-missing","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}