{"record":{"id":"b6411a7fe5ef2cac","repo":"hashicorp/nomad","slug":"unknown-binding-rule-bind-type-s","errorCode":null,"errorMessage":"unknown binding rule bind type: %s","messagePattern":"unknown binding rule bind type: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/binder.go","lineNumber":159,"sourceCode":"// - If the HIL is invalid (\"\", false, AN_ERROR) is returned.\n// - If the computed name is not valid for the type (\"INVALID_NAME\", false, nil) is returned.\n// - If the computed name is valid for the type (\"VALID_NAME\", true, nil) is returned.\nfunc computeBindName(bindType, bindName string, claimMappings map[string]string) (string, bool, error) {\n\tbindName, err := InterpolateHIL(bindName, claimMappings, true)\n\tif err != nil {\n\t\treturn \"\", false, err\n\t}\n\n\tvar valid bool\n\tswitch bindType {\n\tcase structs.ACLBindingRuleBindTypePolicy:\n\t\tvalid = structs.ValidPolicyName.MatchString(bindName)\n\tcase structs.ACLBindingRuleBindTypeRole:\n\t\tvalid = structs.ValidACLRoleName.MatchString(bindName)\n\tcase structs.ACLManagementToken:\n\t\tvalid = true\n\tdefault:\n\t\treturn \"\", false, fmt.Errorf(\"unknown binding rule bind type: %s\", bindType)\n\t}\n\n\treturn bindName, valid, nil\n}\n\n// doesSelectorMatch checks that a single selector matches the provided vars.\nfunc doesSelectorMatch(selector string, selectableVars interface{}) bool {\n\tif selector == \"\" {\n\t\treturn true // catch-all\n\t}\n\n\teval, err := bexpr.CreateEvaluator(selector)\n\tif err != nil {\n\t\treturn false // fails to match if selector is invalid\n\t}\n\n\tresult, err := eval.Evaluate(selectableVars)\n\tif err != nil {","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/lib/auth/binder.go#L141-L177","documentation":"computeBindName hits a BindType value it does not recognize after HIL interpolation. Only policy, role, and management bind types are supported; anything else returns this error, which Bind wraps as error 2010.","triggerScenarios":"An ACL binding rule persisted with an unknown/misspelled BindType value, or internal code passing structs.ACLManagementToken-style constants that no longer match the expected bind-type strings.","commonSituations":"Manual state edits or API writes with an invalid bind type; upgrading across versions where bind type constants changed; a typo like 'rol' or 'Management' (case mismatch) when creating binding rules.","solutions":["List the auth method's binding rules and correct the BindType to one of: policy, role, management","Delete the offending binding rule and recreate it via the official API","Ensure you use the SDK/API constants rather than hand-written strings"],"exampleFix":"// before\n{\"BindType\": \"roles\", \"BindName\": \"${team}\"}\n// after\n{\"BindType\": \"role\", \"BindName\": \"${team}\"}","handlingStrategy":"validation","validationCode":"var validBindTypes = map[string]bool{\"policy\": true, \"role\": true, \"management\": true}\nfunc bindTypeIsValid(t string) bool { return validBindTypes[t] }","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"unknown binding rule bind type\") {\n    return fmt.Errorf(\"binding rule misconfigured: %w\", err)\n}","preventionTips":["Always create binding rules through the API/CLI so bind types are validated server-side","Never hand-edit state store data containing binding rules","Use SDK constants instead of raw strings for BindType"],"tags":["auth","acl-binding-rule","invalid-enum"],"backgroundTag":"invalid-enum-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}