{"record":{"id":"fcc601dc7459a601","repo":"hashicorp/nomad","slug":"failed-to-generate-acl-token-name-w","errorCode":null,"errorMessage":"failed to generate ACL token name: %w","messagePattern":"failed to generate ACL token name: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/acl_endpoint.go","lineNumber":3112,"sourceCode":"\n\treturn nil\n}\n\nfunc formatTokenName(format, authType, authName string, claims map[string]string) (string, error) {\n\tclaimMappings := map[string]string{\n\t\t\"auth_method_type\": authType,\n\t\t\"auth_method_name\": authName,\n\t}\n\tfor k, v := range claims {\n\t\tclaimMappings[\"value.\"+k] = v\n\t}\n\n\tif format == \"\" {\n\t\tformat = structs.DefaultACLAuthMethodTokenNameFormat\n\t}\n\ttokenName, err := auth.InterpolateHIL(format, claimMappings, false)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to generate ACL token name: %w\", err)\n\t}\n\n\treturn tokenName, nil\n}\n\n// oidcRequest builds the request to send to the cap library.\n// The way the cap lib is structured, you can build the request once,\n// and use it for different request types.\nfunc (a *ACL) oidcRequest(nonce, redirect string, config *structs.ACLAuthMethodConfig) (*capOIDC.Req, error) {\n\topts := []capOIDC.Option{\n\t\tcapOIDC.WithNonce(nonce),\n\t}\n\n\tif len(config.OIDCScopes) > 0 {\n\t\topts = append(opts, capOIDC.WithScopes(config.OIDCScopes...))\n\t}\n\tif len(config.BoundAudiences) > 0 {\n\t\topts = append(opts, capOIDC.WithAudiences(config.BoundAudiences...))","sourceCodeStart":3094,"sourceCodeEnd":3130,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/acl_endpoint.go#L3094-L3130","documentation":"Thrown by formatTokenName when InterpolateHIL fails to render the auth method's token_name_format template against the mapped claims. The format string uses HIL interpolation over claim mappings, so a malformed template or a reference to a claim key that does not exist causes this error.","triggerScenarios":"formatTokenName is called from OIDCCompleteAuth or Login and auth.InterpolateHIL(format, claimMappings, false) returns an error — usually a syntactically bad template or missing interpolation variable.","commonSituations":"token_name_format references a claim (e.g. {{user.email}}) that the IdP never provides or that was not mapped in claim_mappings, unbalanced braces, or special characters the HIL parser rejects.","solutions":["Check the wrapped HIL error: fix the template syntax (balanced {{...}} delimiters) in token_name_format.","Ensure every variable referenced in token_name_format exists in claim_mappings and that the IdP actually emits that claim for the logging-in user.","Add a fallback literal or a default so the format never references an optional claim directly.","Temporarily unset token_name_format to use DefaultACLAuthMethodTokenNameFormat and confirm the rest of the flow works."],"exampleFix":"// before\n\"token_name_format\": \"{{user.email}}-token\"\n// after: guarantee the claim is mapped / provide safe format\n\"claim_mappings\": { \"email\": \"user.email\" },\n\"token_name_format\": \"{{user.email}}-token\"","handlingStrategy":"validation","validationCode":"// validate token_name_format variables against claim_mappings before Upsert\nfor _, v := range extractHILVars(method.Config.TokenNameFormat) {\n  if _, ok := method.Config.ClaimMappings[v]; !ok {\n    return fmt.Errorf(\"token_name_format references unmapped claim %q\", v)\n  }\n}","typeGuard":null,"tryCatchPattern":"name, err := auth.InterpolateHIL(format, claimMappings, false)\nif err != nil {\n    return \"\", fmt.Errorf(\"failed to generate ACL token name: %w\", err)\n}","preventionTips":["Only reference claims listed in claim_mappings and emitted by the IdP.","Keep templates simple; test them with a sample claims payload.","Balance {{ }} braces — validate format strings when editing configs."],"tags":["template","hil","acl","nomad"],"backgroundTag":"template-interpolation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}