{"record":{"id":"c8cf4ced604a5c75","repo":"hashicorp/nomad","slug":"failed-to-make-pkce-verifier-w","errorCode":null,"errorMessage":"failed to make pkce verifier: %w","messagePattern":"failed to make pkce verifier: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/acl_endpoint.go","lineNumber":3136,"sourceCode":"// oidcRequest builds the request to send to the cap library.\n// The way the cap lib is structured, you can build the request once,\n// and use it for different request types.\nfunc (a *ACL) oidcRequest(nonce, redirect string, config *structs.ACLAuthMethodConfig) (*capOIDC.Req, error) {\n\topts := []capOIDC.Option{\n\t\tcapOIDC.WithNonce(nonce),\n\t}\n\n\tif len(config.OIDCScopes) > 0 {\n\t\topts = append(opts, capOIDC.WithScopes(config.OIDCScopes...))\n\t}\n\tif len(config.BoundAudiences) > 0 {\n\t\topts = append(opts, capOIDC.WithAudiences(config.BoundAudiences...))\n\t}\n\n\tif config.OIDCEnablePKCE {\n\t\tverifier, err := capOIDC.NewCodeVerifier()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to make pkce verifier: %w\", err)\n\t\t}\n\t\topts = append(opts, capOIDC.WithPKCE(verifier))\n\t}\n\n\tif config.OIDCClientAssertion.IsSet() {\n\t\tj, err := a.oidcClientAssertion(config)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\topts = append(opts, capOIDC.WithClientAssertionJWT(j))\n\t}\n\n\treq, err := capOIDC.NewRequest(\n\t\taclOIDCAuthURLRequestExpiryTime,\n\t\tredirect,\n\t\topts...,\n\t)\n\tif err != nil {","sourceCodeStart":3118,"sourceCodeEnd":3154,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/acl_endpoint.go#L3118-L3154","documentation":"Thrown by oidcRequest when capOIDC.NewCodeVerifier() fails to generate a PKCE code verifier while OIDCEnablePKCE is true. The cap library generates a cryptographically random verifier; failure indicates the runtime entropy source or verifier generation constraints failed.","triggerScenarios":"config.OIDCEnablePKCE is true and capOIDC.NewCodeVerifier() returns an error — effectively only on systems where crypto/rand fails (entropy exhaustion, sandboxed/containers with restricted /dev/urandom).","commonSituations":"Running Nomad servers in restricted containers or VMs with a depleted entropy pool; corrupted Go crypto runtime. Extremely rare in practice.","solutions":["Verify /dev/urandom (crypto/rand) is available and not exhausted on the Nomad server host.","Check the host container/seccomp policy is not blocking getrandom(2).","Restart the Nomad server agent and retry the OIDC login.","If PKCE is not required by the IdP, disable OIDCEnablePKCE as a workaround."],"exampleFix":"// before\n\"OIDCEnablePKCE\": true\n// after (only if IdP supports PKCE properly and entropy issue is host-side, fix host; or disable)\n\"OIDCEnablePKCE\": false","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"verifier, err := capOIDC.NewCodeVerifier()\nif err != nil {\n    return nil, fmt.Errorf(\"failed to make pkce verifier: %w\", err)\n}","preventionTips":["Ensure /dev/urandom and getrandom(2) work in server containers/VMs.","Enable PKCE only when the IdP supports it.","Monitor entropy-related errors on hosts hosting Nomad servers."],"tags":["pkce","oidc","crypto","nomad"],"backgroundTag":"entropy-source-unavailable","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}