{"record":{"id":"71186c530ae798c0","repo":"hashicorp/nomad","slug":"could-not-retrieve-jwt-accessor-w","errorCode":null,"errorMessage":"[✘] Could not retrieve JWT accessor: %w","messagePattern":"\\[✘\\] Could not retrieve JWT accessor: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/setup_vault.go","lineNumber":466,"sourceCode":"\n\t_, err = s.vLogical.WriteBytes(path, buf)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"[✘] Could not create Vault role: %w\", err)\n\t}\n\n\ts.Ui.Info(fmt.Sprintf(\"[✔] Created role %q.\", vaultRole))\n\treturn nil\n}\n\nfunc (s *SetupVaultCommand) policyExists() bool {\n\texistingPolicies, _ := s.vClient.Sys().ListPolicies()\n\treturn slices.Contains(existingPolicies, vaultPolicyName)\n}\n\nfunc (s *SetupVaultCommand) renderPolicy() (string, error) {\n\tsecret, err := s.vLogical.Read(\"sys/auth/\" + vaultPath)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"[✘] Could not retrieve JWT accessor: %w\", err)\n\t}\n\taccessor := secret.Data[\"accessor\"].(string)\n\n\treturn renderVaultPolicy(string(vaultPolicyBody), accessor, s.kvPath), nil\n}\n\nfunc renderVaultPolicy(policyBody, accessor, kvPath string) string {\n\tpolicyText := strings.ReplaceAll(policyBody, \"auth_jwt_X\", accessor)\n\tmount := strings.Trim(kvPath, \"/\")\n\treturn strings.ReplaceAll(policyText, \"secret/\", mount+\"/\")\n}\n\nfunc (s *SetupVaultCommand) createPolicy(policyText string) error {\n\tencoded := base64.StdEncoding.EncodeToString([]byte(policyText))\n\tpolicyBody := fmt.Sprintf(`{\"policy\": \"%s\"}`, encoded)\n\tbuf := []byte(policyBody)\n\n\tpath := \"sys/policies/acl/\" + vaultPolicyName","sourceCodeStart":448,"sourceCodeEnd":484,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/setup_vault.go#L448-L484","documentation":"renderPolicy reads sys/auth/<path> to obtain the JWT auth method's accessor, needed to render the Nomad policy. The read failing is wrapped as 'Could not retrieve JWT accessor'. Additionally the type assertion on Data[\"accessor\"] follows the read.","triggerScenarios":"s.vLogical.Read(\"sys/auth/<vaultPath>\") errors — JWT auth method not yet enabled at that path, token lacks access to sys/auth, or Vault connection failure.","commonSituations":"Running policy rendering before the JWT backend was enabled; token without sudo on sys/auth; wrong vaultPath flag; Vault sealed.","solutions":["Enable the JWT auth method first (run the auth-method creation step) before rendering the policy","Grant the token read capability on sys/auth and sys/auth/*","Verify -vault-path matches the path where JWT auth is mounted","Check Vault connectivity and unsealed state"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-check: mount exists\n// vault auth list | grep <path>  AND vault token capabilities sys/auth/<path>  # expect: read","typeGuard":null,"tryCatchPattern":"var apiErr *api.ResponseError\nif errors.As(err, &apiErr) && apiErr.StatusCode == 403 {\n    // token lacks sys/auth read; escalate privileges\n}","preventionTips":["Run the auth-method enable step before policy rendering","Verify the -vault-path flag matches the mounted JWT backend","Confirm token has read on sys/auth/*"],"tags":["vault","jwt","permissions","policy"],"backgroundTag":"vault-read-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}