{"record":{"id":"793651ac7fa84462","repo":"hashicorp/nomad","slug":"missing-redirect-uri","errorCode":null,"errorMessage":"missing redirect URI","messagePattern":"missing redirect URI","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":2337,"sourceCode":"\t// mechanism. This request doesn't write anything to Nomad's internal\n\t// state.\n\tWriteRequest\n}\n\n// Validate ensures the request object contains all the required fields in\n// order to start the OIDC authentication flow.\nfunc (a *ACLOIDCAuthURLRequest) Validate() error {\n\n\tvar mErr multierror.Error\n\n\tif a.AuthMethodName == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing auth method name\"))\n\t}\n\tif a.ClientNonce == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing client nonce\"))\n\t}\n\tif a.RedirectURI == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing redirect URI\"))\n\t}\n\treturn mErr.ErrorOrNil()\n}\n\n// ACLOIDCAuthURLResponse is the response when starting the OIDC authentication\n// login flow.\ntype ACLOIDCAuthURLResponse struct {\n\n\t// AuthURL is URL to begin authorization and is where the user logging in\n\t// should go.\n\tAuthURL string\n}\n\n// ACLOIDCCompleteAuthRequest is the request object to begin completing the\n// OIDC auth cycle after receiving the callback from the OIDC provider.\ntype ACLOIDCCompleteAuthRequest struct {\n\n\t// AuthMethodName is the name of the auth method being used to login via","sourceCodeStart":2319,"sourceCodeEnd":2355,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L2319-L2355","documentation":"ACLOIDCAuthURLRequest.Validate requires RedirectURI to be non-empty. The redirect URI is where the OIDC provider sends the user after authentication and must match the provider's registered callback. An empty RedirectURI makes the auth URL impossible to construct, so 'missing redirect URI' is appended.","triggerScenarios":"Calling the OIDC auth-url endpoint with ACLOIDCAuthURLRequest.RedirectURI == \"\", e.g. 'nomad login' run without a callback listener/flag or a hand-built API request lacking RedirectURI.","commonSituations":"Running 'nomad login' in an environment where a local callback server cannot bind (hence no redirect URI); CI/automation calling the API directly without configuring the callback; mismatched callback config later rejected by the IdP.","solutions":["Set RedirectURI to the registered OIDC callback (e.g. http://localhost:8000/oidc/callback)","Ensure the CLI can start its local callback listener or pass the redirect URI explicitly","Match the RedirectURI exactly to one configured on the OIDC provider"],"exampleFix":"// before\nreq := &structs.ACLOIDCAuthURLRequest{AuthMethodName: \"auth0\", ClientNonce: nonce}\n// after\nreq := &structs.ACLOIDCAuthURLRequest{AuthMethodName: \"auth0\", ClientNonce: nonce, RedirectURI: \"http://localhost:8000/oidc/callback\"}","handlingStrategy":"validation","validationCode":"if req.RedirectURI == \"\" { return errors.New(\"RedirectURI must match a callback registered on the OIDC provider\") }","typeGuard":"func hasRedirectURI(req *structs.ACLOIDCAuthURLRequest) bool { return req != nil && req.RedirectURI != \"\" }","tryCatchPattern":"if err := req.Validate(); err != nil {\n  if strings.Contains(err.Error(), \"missing redirect URI\") { /* configure callback and retry */ }\n}","preventionTips":["Define the callback URL as configuration, never derive it ad hoc","Verify the CLI can bind its local callback listener before starting login","Keep the redirect URI identical across auth-url and complete-auth steps"],"tags":["nomad","acl","oidc","validation","redirect-uri"],"backgroundTag":"missing-redirect-uri","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}