{"record":{"id":"8c51a3c4cab3e40f","repo":"hashicorp/nomad","slug":"unknown-oidc-keysource-q","errorCode":null,"errorMessage":"unknown OIDC KeySource %q","messagePattern":"unknown OIDC KeySource %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/oidc/client_assertion.go","lineNumber":113,"sourceCode":"\t\t\t)\n\t\t} else {\n\t\t\t// otherwise, derive it from the cert\n\t\t\tcert, err := getCassCert(as.PrivateKey)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tkeyID, err := hashKeyID(cert, as.PrivateKey.KeyIDHeader)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\topts = append(opts, cass.WithHeaders(map[string]string{\n\t\t\t\tstring(as.PrivateKey.KeyIDHeader): keyID,\n\t\t\t}))\n\t\t}\n\t\treturn cass.NewJWTWithRSAKey(clientID, as.Audience, algo, rsaKey, opts...)\n\n\tdefault: // this shouldn't happen, but just in case\n\t\treturn nil, fmt.Errorf(\"unknown OIDC KeySource %q\", as.KeySource)\n\t}\n}\n\n// getCassPrivateKey parses the structs.OIDCClientAssertionKey PemKeyFile\n// or PemKey, depending on which is set.\nfunc getCassPrivateKey(k *structs.OIDCClientAssertionKey) (key *rsa.PrivateKey, err error) {\n\tvar bts []byte\n\tvar source string // for informative error messages\n\n\t// pem file on disk\n\tif k.PemKeyFile != \"\" {\n\t\tsource = \"PemKeyFile\"\n\t\tbts, err = os.ReadFile(k.PemKeyFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading %s: %w\", source, err)\n\t\t}\n\t}\n\t// or pem string","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/lib/auth/oidc/client_assertion.go#L95-L131","documentation":"BuildClientAssertionJWT builds a signed client-assertion JWT for OIDC login, and the OIDCClientAssertion's KeySource field holds a value the builder does not implement. The default branch is a defensive catch-all: KeySource must be one of the supported structs.OIDCClientAssertionKeySource values, and this value is not.","triggerScenarios":"oidcClientAssertion → BuildClientAssertionJWT during OIDC auth with client assertion configured, when the API payload contains an unrecognized/empty KeySource (e.g. a typo or a KeySource added in a newer Nomad than the running server).","commonSituations":"Terraform/Nomad API config with misspelled KeySource string; config written for a newer Nomad version running on an older binary; empty KeySource field in the auth method config.","solutions":["Set KeySource to a supported value (e.g. the private-key / private-key-file variants defined in structs) — check the exact accepted strings in structs.ACLAuthMethodConfig docs.","Verify Nomad server version matches the config: a KeySource from a newer release needs an upgraded binary.","Fix typos in the API/terraform payload before submitting the auth method."],"exampleFix":"// before\nassertion := &structs.OIDCClientAssertion{\n  KeySource: \"private_key_file\",\n}\n// after: exact supported enum value\nassertion := &structs.OIDCClientAssertion{\n  KeySource: structs.OIDCClientAssertionKeySourcePrivateKeyFile,\n}","handlingStrategy":"validation","validationCode":"switch assertion.KeySource {\ncase structs.OIDCClientAssertionKeySourcePrivateKey,\n     structs.OIDCClientAssertionKeySourcePrivateKeyFile:\n  // ok\ndefault:\n  return fmt.Errorf(\"KeySource %q unsupported by this Nomad server\", assertion.KeySource)\n}","typeGuard":"func keySourceSupported(ks structs.OIDCClientAssertionKeySource) bool {\n  switch ks {\n  case structs.OIDCClientAssertionKeySourcePrivateKey,\n       structs.OIDCClientAssertionKeySourcePrivateKeyFile:\n    return true\n  }\n  return false\n}","tryCatchPattern":"jwt, err := client.BuildClientAssertionJWT(ctx, assertion)\nif err != nil && strings.Contains(err.Error(), \"unknown OIDC KeySource\") {\n  return fmt.Errorf(\"fix KeySource in auth method config or upgrade Nomad: %w\", err)\n}","preventionTips":["Reference the enum constants from the structs package instead of raw strings in Terraform/SDK code.","Pin Nomad CLI/API versions to the server version when writing auth method configs.","Validate auth method config with `nomad acl auth-method` dry runs before applying."],"tags":["oidc","client-assertion","config","validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}