{"record":{"id":"cbc6cd7e6f709739","repo":"hashicorp/nomad","slug":"bind-name-should-be-empty","errorCode":null,"errorMessage":"bind name should be empty","messagePattern":"bind name should be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":2105,"sourceCode":"\t\tmErr.Errors = append(mErr.Errors, errors.New(\"auth method is missing\"))\n\t}\n\tif len(a.Description) > maxACLBindingRuleDescriptionLength {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"description longer than %d\", maxACLRoleDescriptionLength))\n\t}\n\n\t// Depending on the bind type, we have some specific validation. Catching\n\t// the empty string also provides easier to understand feedback to the\n\t// user.\n\tswitch a.BindType {\n\tcase \"\":\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"bind type is missing\"))\n\tcase ACLBindingRuleBindTypeRole, ACLBindingRuleBindTypePolicy:\n\t\tif a.BindName == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, errors.New(\"bind name is missing\"))\n\t\t}\n\tcase ACLBindingRuleBindTypeManagement:\n\t\tif a.BindName != \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, errors.New(\"bind name should be empty\"))\n\t\t}\n\tdefault:\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"unsupported bind type: %q\", a.BindType))\n\t}\n\n\t// If there is a selector configured, ensure that go-bexpr can parse this.\n\t// Otherwise, the user will get an ambiguous failure when attempting to\n\t// login.\n\tif a.Selector != \"\" {\n\t\tif _, err := bexpr.CreateEvaluator(a.Selector, nil); err != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"selector is invalid: %v\", err))\n\t\t}\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\n// Merge merges binding rule a with b. It sets all required empty fields of rule","sourceCodeStart":2087,"sourceCodeEnd":2123,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L2087-L2123","documentation":"ACLBindingRule.Validate enforces that a bind rule of type 'management' carries an empty BindName, because management tokens are not bound to any specific policy or role. When BindName is set on a management-typed rule, Validate appends 'bind name should be empty' to its multierror. It is a configuration schema error for Nomad ACL binding rules.","triggerScenarios":"Calling ACL Binding Rule Create/Update (ACLBindingRule with BindType \"management\") via the Nomad API or CLI while BindName is non-empty. E.g. copying a role-bound rule and only changing BindType to 'management' without clearing BindName.","commonSituations":"Operators editing binding rules via 'nomad acl binding-rule update' or Terraform/IaC that populates bind_name unconditionally; migrating rules from 'role'/'policy' types to 'management'; hand-written JSON payloads that leave bind_name filled.","solutions":["Set BindName to \"\" when BindType is ACLBindingRuleBindTypeManagement","If a specific role/policy is intended, keep BindType as 'role' or 'policy' instead of 'management'","Remove stale bind_name fields from IaC/JSON templates for management rules","Fix the payload client-side before calling acl binding-rule create/update"],"exampleFix":"// before\nrule := &structs.ACLBindingRule{\n  BindType: structs.ACLBindingRuleBindTypeManagement,\n  BindName: \"admin-role\",\n}\n// after\nrule := &structs.ACLBindingRule{\n  BindType: structs.ACLBindingRuleBindTypeManagement,\n  BindName: \"\",\n}","handlingStrategy":"validation","validationCode":"if rule.BindType == structs.ACLBindingRuleBindTypeManagement && rule.BindName != \"\" { return errors.New(\"BindName must be empty for management binding rules\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Reset BindName when changing BindType to management","Test binding rule payloads with Validate() in unit tests","Audit IaC modules that set bind_name unconditionally"],"tags":["nomad","acl","validation","binding-rule"],"backgroundTag":"acl-binding-rule-invalid-bind-name","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}