{"record":{"id":"bd9d608299aafefd","repo":"hashicorp/nomad","slug":"unexpected-clockskewleeway-type-v-bd9d60","errorCode":null,"errorMessage":"unexpected ClockSkewLeeway type: %v","messagePattern":"unexpected ClockSkewLeeway type: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":1706,"sourceCode":"\t\t\t}\n\t\tcase float64:\n\t\t\ta.NotBeforeLeeway = time.Duration(v)\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unexpected NotBeforeLeeway type: %v\", v)\n\t\t}\n\t}\n\tif aux.ClockSkewLeeway != nil {\n\t\tswitch v := aux.ClockSkewLeeway.(type) {\n\t\tcase string:\n\t\t\tif v != \"\" {\n\t\t\t\tif a.ClockSkewLeeway, err = time.ParseDuration(v); err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\t\t\t}\n\t\tcase float64:\n\t\t\ta.ClockSkewLeeway = time.Duration(v)\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unexpected ClockSkewLeeway type: %v\", v)\n\t\t}\n\t}\n\treturn nil\n}\n\ntype OIDCClientAssertionKeySource string\n\nconst (\n\tOIDCKeySourceNomad        OIDCClientAssertionKeySource = \"nomad\"\n\tOIDCKeySourceClientSecret OIDCClientAssertionKeySource = \"client_secret\"\n\tOIDCKeySourcePrivateKey   OIDCClientAssertionKeySource = \"private_key\"\n)\n\n// OIDCClientAssertion (a.k.a private_key_jwt) is used to send\n// a client_assertion along with an OIDC token request.\n// See api.OIDCClientAssertion for full field descriptions.\ntype OIDCClientAssertion struct {\n\tKeySource    OIDCClientAssertionKeySource","sourceCodeStart":1688,"sourceCodeEnd":1724,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L1688-L1724","documentation":"Returned by ACLAuthMethod's ClockSkewLeeway unmarshaling/validation when the JSON/HCL value for `ClockSkewLeeway` is neither a string (duration) nor a float64. The field is decoded in a type-switch, and any other Go type (e.g. bool, map, nested object) reaches the default branch. It indicates a malformed duration value in the auth method configuration.","triggerScenarios":"Submitting an ACL auth method (ACLAuthMethodUpsertRequest or nomad acl auth-method create/update) where ClockSkewLeeway is given a value that decodes to a type other than string or float64 - e.g. a YAML/HCL bool, list, or nested map instead of a duration string like \"5m\".","commonSituations":"HCL config with `clock_skew_leeway = true` or an unquoted bare word; JSON job/config where the duration was accidentally left as an object; tooling emitting wrong JSON types; copy-paste of a struct literal instead of a duration string.","solutions":["Set ClockSkewLeeway to a duration string, e.g. \"5m\" or \"300s\".","In JSON, ensure the value is a quoted string (or plain number of nanoseconds) - not a bool/object.","Re-run the auth-method create/update after fixing the config."],"exampleFix":"// before\nclock_skew_leeway = true\n\n// after\nclock_skew_leeway = \"5m\"","handlingStrategy":"validation","validationCode":"v, ok := rawClockSkewLeeway.(string)\nif !ok {\n    if _, isNum := rawClockSkewLeeway.(float64); !isNum {\n        return fmt.Errorf(\"clock_skew_leeway must be a duration string, got %T\", rawClockSkewLeeway)\n    }\n}\nif _, err := time.ParseDuration(v); err != nil {\n    return fmt.Errorf(\"clock_skew_leeway invalid duration: %w\", err)\n}","typeGuard":"func isClockSkewLeewayValue(v interface{}) bool {\n    switch v.(type) {\n    case string, float64:\n        return true\n    default:\n        return false\n    }\n}","tryCatchPattern":null,"preventionTips":["Always quote duration values in HCL/YAML configs.","Validate config JSON types before calling the Nomad API.","Use typed config structs with time.Duration parsing helpers."],"tags":["nomad","acl","auth-method","configuration","type-mismatch"],"backgroundTag":"config-field-type-mismatch","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}