{"record":{"id":"e73bcf2a8b849a5a","repo":"hashicorp/nomad","slug":"missing-auth-method-config","errorCode":null,"errorMessage":"missing auth method Config","messagePattern":"missing auth method Config","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":1578,"sourceCode":"func (a *ACLAuthMethodConfig) Canonicalize() {\n\tif a == nil {\n\t\treturn\n\t}\n\tif a.OIDCClientAssertion != nil {\n\t\t// client assertions inherit certain values from auth method\n\t\tif len(a.OIDCClientAssertion.Audience) == 0 {\n\t\t\ta.OIDCClientAssertion.Audience = []string{a.OIDCDiscoveryURL}\n\t\t}\n\t\t// the client assertion inherits the client secret,\n\t\t// in case KeySource = \"client_secret\"\n\t\ta.OIDCClientAssertion.ClientSecret = a.OIDCClientSecret\n\t\ta.OIDCClientAssertion.Canonicalize()\n\t}\n}\n\nfunc (a *ACLAuthMethodConfig) Validate(methodType string) error {\n\tif a == nil {\n\t\treturn errors.New(\"missing auth method Config\")\n\t}\n\tmErr := &multierror.Error{}\n\n\tswitch methodType {\n\tcase ACLAuthMethodTypeOIDC:\n\t\tif a.OIDCDiscoveryURL == \"\" {\n\t\t\tmErr = multierror.Append(mErr, errors.New(\"missing OIDCDiscoveryURL\"))\n\t\t}\n\t\tif a.OIDCClientID == \"\" {\n\t\t\tmErr = multierror.Append(mErr, errors.New(\"missing OIDCClientID\"))\n\t\t}\n\t\tif err := a.OIDCClientAssertion.Validate(); err != nil {\n\t\t\tmErr = multierror.Append(mErr, fmt.Errorf(\"invalid client assertion config: %w\", err))\n\t\t}\n\n\tcase ACLAuthMethodTypeJWT:\n\t\tif a.OIDCDiscoveryURL == \"\" && a.JWKSURL == \"\" && len(a.JWTValidationPubKeys) == 0 {\n\t\t\tmErr = multierror.Append(mErr, errors.New(","sourceCodeStart":1560,"sourceCodeEnd":1596,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L1560-L1596","documentation":"ACLAuthMethodConfig.Validate is called with the method's type; if the Config struct itself is nil there is nothing to validate, so it returns this error. The auth method was declared but its configuration block is absent.","triggerScenarios":"Creating/updating an OIDC or JWT auth method (ACL.UpsertACLAuthMethods) without a Config, or with an explicitly nil Config, so the server passes nil into ACLAuthMethodConfig.Validate(methodType).","commonSituations":"HCL/JSON auth method stanzas missing the config block; API clients that build ACLAuthMethod without instantiating Config; upgrades where an older method definition lacks the newly required config section.","solutions":["Populate the auth method's Config, including OIDCDiscoveryURL/OIDCClientID (OIDC) or a validation source (JWT)","If the method intentionally has no config, it cannot use OIDC/JWT types — use a type that does not require Config"],"exampleFix":"// before\nmethod := &api.ACLAuthMethod{Name: \"okta\", Type: \"oidc\"}\n// after\nmethod := &api.ACLAuthMethod{Name: \"okta\", Type: \"oidc\",\n  Config: &api.ACLAuthMethodConfig{OIDCDiscoveryURL: \"https://issuer\", OIDCClientID: \"nomad\"}}","handlingStrategy":"validation","validationCode":"if method.Type == \"oidc\" && method.Config == nil {\n  return errors.New(\"auth method of type oidc requires a config block\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always instantiate Config when using oidc/jwt auth methods","Lint HCL/JSON stanzas for required config blocks"],"tags":["nomad","acl","sso","validation"],"backgroundTag":"missing-config-block","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}