{"record":{"id":"7d7046acd1529538","repo":"hashicorp/nomad","slug":"failed-to-get-active-nomad-key-w","errorCode":null,"errorMessage":"failed to get active nomad key: %w","messagePattern":"failed to get active nomad key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/acl_endpoint.go","lineNumber":3167,"sourceCode":"\treq, err := capOIDC.NewRequest(\n\t\taclOIDCAuthURLRequestExpiryTime,\n\t\tredirect,\n\t\topts...,\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create OIDC request: %v\", err)\n\t}\n\n\treturn req, nil\n}\n\nfunc (a *ACL) oidcClientAssertion(config *structs.ACLAuthMethodConfig) (*cass.JWT, error) {\n\t// this nomad key will only actually be used if the client assertion config\n\t// KeySource = \"nomad\", but we get it here to avoid exposing more of the\n\t// codebase to the encrypter.\n\tnomadKey, nomadKID, err := a.srv.encrypter.GetActiveKey()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get active nomad key: %w\", err)\n\t}\n\tj, err := oidc.BuildClientAssertionJWT(config, nomadKey, nomadKID)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to build client_assertion jwt: %w\", err)\n\t}\n\tif config.VerboseLogging {\n\t\t// a user initially setting up the auth method, as one might with\n\t\t// VerboseLogging enabled, may benefit from not having to do a full\n\t\t// login flow to see the jwt (and any possible Serialize() error).\n\t\t// we say \"example\" in the log, because the cap library will run\n\t\t// Serialize() again internally, so it won't use this same jwt.\n\t\ttoken, err := j.Serialize()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to serialize client_assertion jwt: %w\", err)\n\t\t}\n\t\ta.logger.Debug(\"example client_assertion\", \"oidc_client_id\", config.OIDCClientID, \"jwt\", token)\n\t}\n\treturn j, nil","sourceCodeStart":3149,"sourceCodeEnd":3185,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/acl_endpoint.go#L3149-L3185","documentation":"Thrown by oidcClientAssertion when a.srv.encrypter.GetActiveKey() fails to return Nomad's active encryption key and key ID. The key is fetched to build the private_key_jwt client assertion when the auth method's client assertion KeySource is 'nomad'.","triggerScenarios":"Called from oidcRequest (during GetAuthMethod/OIDCAuthURL flows) or UpsertAuthMethods; the server's keyring encrypter is unavailable or not initialized — e.g. keyring not yet installed, key replication pending in a new region, or enterprise keyring corruption.","commonSituations":"Freshly-bootstrapped cluster before the initial keyring is created (Nomad Enterprise), a non-enterprise binary/config path where the encrypter is not wired, region replication lag, or keyring restore from backup failing.","solutions":["Check the wrapped cause and nomad server logs for keyring/encrypter initialization errors.","On Nomad Enterprise, ensure the keyring is installed: nomad keyring list / rotate, and that the region has replicated keys.","Restart the server agent so the encrypter re-initializes; verify raft keyring entries are healthy.","Confirm KeySource is intentionally 'nomad' in OIDCClientAssertion; otherwise fix the auth method config."],"exampleFix":"// before: client assertion pointing at nomad key on a cluster without keyring\n\"OIDCClientAssertion\": { \"KeySource\": \"nomad\" }\n// after: either install/verify the keyring or supply a static private key\nnomad keyring list\n\"OIDCClientAssertion\": { \"KeySource\": \"nomad\" } // run on Enterprise with keyring initialized","handlingStrategy":"try-catch","validationCode":"// preflight: confirm keyring is initialized (Nomad Enterprise)\nout, err := exec.Command(\"nomad\", \"keyring\", \"list\").Output()\nif err != nil || strings.Contains(string(out), \"No keys\") {\n  return errors.New(\"nomad keyring not initialized\")\n}","typeGuard":null,"tryCatchPattern":"key, kid, err := a.srv.encrypter.GetActiveKey()\nif err != nil {\n    return nil, fmt.Errorf(\"failed to get active nomad key: %w\", err)\n}","preventionTips":["Install/verify the keyring before enabling client assertion KeySource=nomad.","Confirm you are on Nomad Enterprise when using nomad-sourced keys.","Watch keyring replication health across regions."],"tags":["keyring","encryption","oidc","nomad","enterprise"],"backgroundTag":"keyring-unavailable","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}