{"record":{"id":"76f5cbb5d548e923","repo":"hashicorp/nomad","slug":"error-converting-claim-s-to-string-from-unknown","errorCode":null,"errorMessage":"error converting claim '%s' to string from unknown type %T","messagePattern":"error converting claim '(.+?)' to string from unknown type %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/claims.go","lineNumber":77,"sourceCode":"\t\tValue: values,\n\t\tList:  list,\n\t}, nil\n}\n\n// extractMappings extracts the string value mappings.\nfunc extractMappings(\n\tall map[string]interface{}, mapping map[string]string) (map[string]string, error) {\n\n\tresult := make(map[string]string)\n\tfor source, target := range mapping {\n\t\trawValue := getClaim(all, source)\n\t\tif rawValue == nil {\n\t\t\tcontinue\n\t\t}\n\n\t\tstrValue, ok := stringifyClaimValue(rawValue)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"error converting claim '%s' to string from unknown type %T\",\n\t\t\t\tsource, rawValue)\n\t\t}\n\n\t\tresult[target] = strValue\n\t}\n\n\treturn result, nil\n}\n\n// extractListMappings builds a metadata map of string list values from a set\n// of claims and claims mappings.  The referenced claims must be strings and\n// the claims mappings must be of the structure:\n//\n//\t{\n//\t    \"/some/claim/pointer\": \"metadata_key1\",\n//\t    \"another_claim\": \"metadata_key2\",\n//\t     ...\n//\t}","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/lib/auth/claims.go#L59-L95","documentation":"extractMappings found a configured ClaimMappings source claim whose value exists but has a Go type stringifyClaimValue cannot convert (e.g. map[string]interface{}, nested object). Login's claim extraction fails and the auth request errors out.","triggerScenarios":"An auth method's ClaimMappings points at a claim (via JSON pointer or key) whose runtime value is a map or other unsupported type — e.g. mapping \"resource_access\" or an OIDC object claim to a string metadata key.","commonSituations":"Keycloak-style nested claims (resource_access.client.roles); IdP changed a claim from string to object after an upgrade; %T in the message reveals map[string]interface {} — a strong hint the pointer targets an object, not a leaf.","solutions":["Read %T in the error to identify the actual claim type","Point the claim mapping at a scalar leaf using a JSON pointer, e.g. /resource_access/myclient/roles/0","Use ListClaimMappings instead of ClaimMappings if the claim is an array","Ask the IdP admin to expose the value as a scalar claim"],"exampleFix":"// before\nClaimMappings: {\"/resource_access\": \"roles\"}\n// after\nListClaimMappings: {\"/resource_access/myclient/roles\": \"roles\"}","handlingStrategy":"type-guard","validationCode":"// verify claim shape before login by decoding the JWT payload\nfunc claimIsScalar(claims map[string]interface{}, key string) bool {\n    v := claims[key]\n    switch v.(type) {\n    case nil, string, bool, float64, []interface{}:\n        return true\n    default:\n        return false // maps/objects will fail stringification\n    }\n}","typeGuard":"func asScalarClaim(v interface{}) (string, bool) {\n    switch t := v.(type) {\n    case string:\n        return t, true\n    case bool:\n        return strconv.FormatBool(t), true\n    case float64:\n        return strconv.FormatInt(int64(t), 10), true\n    default:\n        return \"\", false\n    }\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"to string from unknown type\") {\n    return fmt.Errorf(\"claim mapping targets a non-scalar claim: %w\", err)\n}","preventionTips":["Point ClaimMappings at scalar leaf claims using JSON pointers, never at objects","Decode a sample token and confirm each mapped claim's JSON type","Prefer ListClaimMappings for arrays and objects"],"tags":["auth","oidc-claims","type-conversion"],"backgroundTag":"claim-type-unsupported","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}