{"record":{"id":"a7e10d3b743bd7bd","repo":"hashicorp/nomad","slug":"missing-auth-method-name","errorCode":null,"errorMessage":"missing auth method name","messagePattern":"missing auth method name","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":2331,"sourceCode":"\t// is up to the client to generate this and Go integrations should use the\n\t// oidc.NewID function within the hashicorp/cap library. This must then be\n\t// passed back to ACLOIDCCompleteAuthRequest. This is a required parameter.\n\tClientNonce string\n\n\t// WriteRequest is used due to the requirement by the RPC forwarding\n\t// mechanism. This request doesn't write anything to Nomad's internal\n\t// state.\n\tWriteRequest\n}\n\n// Validate ensures the request object contains all the required fields in\n// order to start the OIDC authentication flow.\nfunc (a *ACLOIDCAuthURLRequest) Validate() error {\n\n\tvar mErr multierror.Error\n\n\tif a.AuthMethodName == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing auth method name\"))\n\t}\n\tif a.ClientNonce == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing client nonce\"))\n\t}\n\tif a.RedirectURI == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing redirect URI\"))\n\t}\n\treturn mErr.ErrorOrNil()\n}\n\n// ACLOIDCAuthURLResponse is the response when starting the OIDC authentication\n// login flow.\ntype ACLOIDCAuthURLResponse struct {\n\n\t// AuthURL is URL to begin authorization and is where the user logging in\n\t// should go.\n\tAuthURL string\n}","sourceCodeStart":2313,"sourceCodeEnd":2349,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L2313-L2349","documentation":"ACLOIDCAuthURLRequest.Validate requires AuthMethodName to be non-empty because the request tells the Nomad server which ACL auth method to start the OIDC login flow against. When AuthMethodName is empty, the server cannot resolve the method, so 'missing auth method name' is appended to the multierror.","triggerScenarios":"Calling the OIDC auth-url endpoint (ACL/AuthMethod OIDC login start) with a request whose AuthMethodName field is unset/empty, e.g. nomad acl oidc login without a usable auth-method name resolved from the CLI or API payload.","commonSituations":"Users running 'nomad login' in a cluster where no default auth method can be inferred; API clients building ACLOIDCAuthURLRequest by hand and forgetting AuthMethodName; auth method deleted/renamed before login.","solutions":["Set AuthMethodName to the name of an existing OIDC auth method","Run 'nomad acl auth-method list' to get the correct name","Provide --auth-method-name (or -method flag) to 'nomad login' explicitly","Verify the auth method was not renamed/deleted"],"exampleFix":"// before\nreq := &structs.ACLOIDCAuthURLRequest{RedirectURI: \"http://localhost:8000/oidc/callback\"}\n// after\nreq := &structs.ACLOIDCAuthURLRequest{AuthMethodName: \"auth0\", RedirectURI: \"http://localhost:8000/oidc/callback\"}","handlingStrategy":"validation","validationCode":"func validOIDCAuthURLRequest(req *structs.ACLOIDCAuthURLRequest) bool {\n  return req.AuthMethodName != \"\" && req.ClientNonce != \"\" && req.RedirectURI != \"\"\n}","typeGuard":"func hasAuthMethodName(req *structs.ACLOIDCAuthURLRequest) bool { return req != nil && req.AuthMethodName != \"\" }","tryCatchPattern":"if err := req.Validate(); err != nil {\n  var mErr *multierror.Error\n  if errors.As(err, &mErr) { /* inspect for 'missing auth method name' and reprompt for method */ }\n}","preventionTips":["Always resolve the auth method name before starting OIDC login","Pass --auth-method-name explicitly to nomad login in scripts","Validate the request struct with Validate() before sending","Check auth method existence with the auth-method read API first"],"tags":["nomad","acl","oidc","validation"],"backgroundTag":"missing-auth-method-name","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}