{"record":{"id":"81478f67f07b9e41","repo":"hashicorp/nomad","slug":"invalid-privatekey-w","errorCode":null,"errorMessage":"invalid PrivateKey: %w","messagePattern":"invalid PrivateKey: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":1781,"sourceCode":"func (c *OIDCClientAssertion) IsSet() bool {\n\treturn c != nil && c.KeySource != \"\"\n}\n\nfunc (c *OIDCClientAssertion) Validate() error {\n\tif c == nil {\n\t\treturn nil\n\t}\n\tif len(c.Audience) == 0 || c.Audience[0] == \"\" {\n\t\treturn errors.New(\"missing Audience\")\n\t}\n\tswitch c.KeySource {\n\tcase OIDCKeySourceNomad:\n\tcase OIDCKeySourcePrivateKey:\n\t\tif c.PrivateKey == nil {\n\t\t\treturn errors.New(\"PrivateKey is required for `private_key` KeySource\")\n\t\t}\n\t\tif err := c.PrivateKey.Validate(); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid PrivateKey: %w\", err)\n\t\t}\n\tcase OIDCKeySourceClientSecret:\n\t\tif c.ClientSecret == \"\" {\n\t\t\treturn errors.New(\"OIDCClientSecret is required for `client_secret` KeySource\")\n\t\t}\n\tdefault:\n\t\treturn fmt.Errorf(\"invalid KeySource %q\", c.KeySource)\n\t}\n\treturn nil\n}\n\ntype OIDCClientAssertionKeyIDHeader string\n\nconst (\n\tOIDCClientAssertionHeaderKid     OIDCClientAssertionKeyIDHeader = \"kid\"\n\tOIDCClientAssertionHeaderX5t     OIDCClientAssertionKeyIDHeader = \"x5t\"\n\tOIDCClientAssertionHeaderX5tS256 OIDCClientAssertionKeyIDHeader = \"x5t#S256\"\n)","sourceCodeStart":1763,"sourceCodeEnd":1799,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L1763-L1799","documentation":"Wraps the validation failure of the OIDCClientAssertion PrivateKey sub-object when the auth client assertion KeySource is `private_key`. The nested PrivateKey.Validate() failed (missing key/cert material or unreadable content), and Nomad re-raises it with the `invalid PrivateKey:` prefix. It means the configured private key for OIDC client authentication is invalid.","triggerScenarios":"Validating an OIDC provider/auth-method whose OIDCClientAssertion has KeySource set to \"private_key\" but whose PrivateKey fails Validate() - e.g. nil/empty PemKey and PemKeyFile, both set simultaneously, or malformed PEM data.","commonSituations":"Paste of PEM content with missing header/footer lines; specifying both pem_key and pem_key_file; uploading a truncated key; referencing a key file path that was emptied by templating.","solutions":["Read the wrapped %w message to see which nested field failed, then supply exactly one valid private key (PemKey or PemKeyFile).","Ensure the PEM block is complete including -----BEGIN/END----- lines.","Verify the referenced file exists and is readable by the Nomad server.","Run the provider validation again after fixing."],"exampleFix":"// before\nkey_source = \"private_key\"\npem_key = \"\"\npem_key_file = \"/etc/ssl/client.key\"\npem_cert_file = \"/etc/ssl/client.crt\"\n\n// after\nkey_source = \"private_key\"\npem_key_file = \"/etc/ssl/client.key\" // complete, valid PEM only","handlingStrategy":"validation","validationCode":"func checkPrivateKey(k *OIDCClientAssertionPrivateKey) error {\n    if k == nil || (k.PemKey == \"\" && k.PemKeyFile == \"\") {\n        return errors.New(\"private key material required\")\n    }\n    if k.PemKey != \"\" && k.PemKeyFile != \"\" {\n        return errors.New(\"set only one of pem_key or pem_key_file\")\n    }\n    if k.PemKey != \"\" && !strings.Contains(k.PemKey, \"-----BEGIN\") {\n        return errors.New(\"pem_key is not a valid PEM block\")\n    }\n    return nil\n}","typeGuard":"func hasValidPEM(s string) bool {\n    return strings.Contains(s, \"-----BEGIN\") && strings.Contains(s, \"-----END\")\n}","tryCatchPattern":"if err := client.ACLAuthMethods().Upsert(...); err != nil {\n    var wrapped interface{ Unwrap() error }\n    if errors.As(err, &target) && strings.Contains(err.Error(), \"invalid PrivateKey\") {\n        // surface nested PrivateKey validation detail to operator\n    }\n}","preventionTips":["Provide exactly one of pem_key or pem_key_file.","Verify PEM files load with openssl before configuring.","Check file readability by the Nomad server user."],"tags":["nomad","acl","oidc","private-key","validation"],"backgroundTag":"invalid-private-key","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}