{"record":{"id":"c175f5f156eae210","repo":"hashicorp/nomad","slug":"failed-to-sign-node-introduction-identity-claims","errorCode":null,"errorMessage":"failed to sign node introduction identity claims: %w","messagePattern":"failed to sign node introduction identity claims: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/acl_endpoint.go","lineNumber":3244,"sourceCode":"\n\t// Generate the node introduction identity TTL based on the server config\n\t// and any possible user provided TTL.\n\tidentityTTL := args.IdentityTTL(\n\t\ta.logger,\n\t\ta.srv.config.NodeIntroductionConfig.DefaultIdentityTTL,\n\t\ta.srv.config.NodeIntroductionConfig.MaxIdentityTTL,\n\t)\n\n\tintroIdentity := structs.GenerateNodeIntroductionIdentityClaims(\n\t\targs.NodeName,\n\t\targs.NodePool,\n\t\targs.Region,\n\t\tidentityTTL,\n\t)\n\n\tsignedIdentity, _, err := a.srv.encrypter.SignClaims(introIdentity)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to sign node introduction identity claims: %w\", err)\n\t}\n\n\treply.JWT = signedIdentity\n\treturn nil\n}\n","sourceCodeStart":3226,"sourceCodeEnd":3250,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/acl_endpoint.go#L3226-L3250","documentation":"CreateClientIntroductionToken builds node introduction identity claims and signs them with the server's keyring via encrypter.SignClaims. If the signing operation fails, the underlying error is wrapped as 'failed to sign node introduction identity claims'. Signing depends on the server holding a valid encryption key, so this indicates a server-side keyring/cryptography problem.","triggerScenarios":"Calling CreateClientIntroductionToken when SignClaims returns an error — e.g. the server's keyring is uninitialized or the signing key is missing/corrupt, or identity claim serialization fails.","commonSituations":"Restored server from backup without the keyring; key rotation left the server without the needed key; corrupted state store/keystore on disk; signing key not yet replicated to a new server.","solutions":["Inspect the wrapped cause (`%w`) in Nomad server logs to identify the keyring error","Verify the server keyring is initialized: check the keystore files under the server's data dir","Ensure the key used for signing was rotated/replicated to all servers (`nomad keyring` operations) and retry","Restart the server so the keyring is reloaded; restore keys from backup if missing"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"failed to sign node introduction identity claims\") {\n    // inspect wrapped cause; retry after keyring health is confirmed\n    log.Printf(\"signing failure: %v\", err)\n}","preventionTips":["Keep server keystore files backed up and consistent across servers","Test key rotation in staging and verify signing works afterwards","Alert on keyring initialization errors at server startup"],"tags":["nomad","signing","keyring","jwt"],"backgroundTag":"jwt-signing-failure","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}