{"record":{"id":"ed5dcf2f825ab3af","repo":"hashicorp/nomad","slug":"failed-to-generate-oidc-provider-v","errorCode":null,"errorMessage":"failed to generate OIDC provider: %v","messagePattern":"failed to generate OIDC provider: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/acl_endpoint.go","lineNumber":2678,"sourceCode":"\t\targs.Region = a.srv.config.AuthoritativeRegion\n\n\t\tif done, err := a.srv.forward(structs.ACLOIDCAuthURLRPCMethod, args, args, reply); done {\n\t\t\treturn err\n\t\t}\n\t}\n\n\toidcReq, err := a.oidcRequestCache.LoadOrAdd(args.ClientNonce, func() (*capOIDC.Req, error) {\n\t\treturn a.oidcRequest(args.ClientNonce, args.RedirectURI, authMethod.Config)\n\t})\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// Use the cache to provide us with an OIDC provider for the auth method\n\t// that was resolved from state.\n\toidcProvider, err := a.oidcProviderCache.Get(authMethod)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to generate OIDC provider: %v\", err)\n\t}\n\n\t// Generate a context. This argument is required by the OIDC provider lib,\n\t// but is not used in any way. This therefore acts for future proofing, if\n\t// the provider lib uses the context.\n\tctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(aclOIDCAuthURLRequestExpiryTime))\n\tdefer cancel()\n\n\t// Generate the URL, handling any error along with the URL.\n\tauthURL, err := oidcProvider.AuthURL(ctx, oidcReq)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to generate auth URL: %v\", err)\n\t}\n\n\treply.AuthURL = authURL\n\treturn nil\n}\n","sourceCodeStart":2660,"sourceCodeEnd":2696,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/acl_endpoint.go#L2660-L2696","documentation":"During OIDCAuthURL, Nomad builds a go-oidc/OpenIDConnect provider object from the auth method's OIDC discovery configuration via the oidcProviderCache. If the provider cannot be constructed (discovery URL unreachable, invalid TLS, malformed discovery document, bad client config), the underlying error is wrapped as 'failed to generate OIDC provider'.","triggerScenarios":"Calling OIDCAuthURL ('nomad login -method=...') where the auth method's OIDCDiscoveryURL is wrong/unreachable, uses bad TLS certs, points to a non-OIDC endpoint, or has an invalid client_id/client_secret/audience pair.","commonSituations":"Typo in the discovery URL; internal OIDC provider behind a firewall not reachable from the servers; self-signed certificates not trusted; IdP discovery document missing required fields; auth method updated after the IdP endpoint changed.","solutions":["Fix the auth method's OIDCDiscoveryURL and verify it is reachable from the Nomad servers (curl <url>/.well-known/openid-configuration).","Check the full wrapped error message for the root cause (DNS, TLS, 404, malformed JSON).","Ensure the IdP hostname's TLS chain is trusted by Nomad servers or install the CA cert.","Re-run 'nomad acl auth-method update' with corrected config, then retry 'nomad login'."],"exampleFix":"// before\nauthMethod := &api.ACLAuthMethod{Name: \"okta\", Type: \"oidc\", Config: &api.ACLAuthMethodConfig{OIDCDiscoveryURL: \"https://okta.example.com/wrong\", OIDCClientID: cid, BoundAudiences: []string{cid}}}\n// after\nauthMethod := &api.ACLAuthMethod{Name: \"okta\", Type: \"oidc\", Config: &api.ACLAuthMethodConfig{OIDCDiscoveryURL: \"https://your-org.okta.com/oauth2/default\", OIDCClientID: cid, BoundAudiences: []string{cid}}}","handlingStrategy":"validation","validationCode":"cfg, _, err := client.ACL().GetAuthMethod(\"okta\", nil)\nif err != nil { return err }\nresp, err := http.Get(cfg.Config.OIDCDiscoveryURL + \"/.well-known/openid-configuration\")\nif err != nil { return fmt.Errorf(\"IdP unreachable from this host: %w\", err) }\nif resp.StatusCode != 200 { return fmt.Errorf(\"discovery returned %d\", resp.StatusCode) }","typeGuard":"func validDiscoveryURL(cfg *api.ACLAuthMethodConfig) bool {\n    if cfg == nil || cfg.OIDCDiscoveryURL == \"\" { return false }\n    u, err := url.Parse(cfg.OIDCDiscoveryURL)\n    return err == nil && (u.Scheme == \"https\" || u.Scheme == \"http\") && u.Host != \"\"\n}","tryCatchPattern":"_, _, err := client.ACL().GetOIDCAuthURL(req, nil)\nif err != nil && strings.Contains(err.Error(), \"failed to generate OIDC provider\") {\n    // root cause is in the wrapped text: DNS, TLS, or bad discovery doc\n    return fmt.Errorf(\"check auth method %q OIDCDiscoveryURL/reachability: %w\", req.AuthMethodName, err)\n}","preventionTips":["curl <discovery-url>/.well-known/openid-configuration from Nomad servers after configuring an auth method","Install the IdP's CA cert on Nomad servers for internal/self-signed providers","Re-validate discovery config after any IdP endpoint change","Keep BoundAudiences/OIDCClientID consistent with the IdP app registration"],"tags":["nomad","acl","oidc","sso","network"],"backgroundTag":"oidc-discovery-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}