hashicorp/nomad · error

bind name is missing

Error message

bind name is missing

What it means

When BindType is "role" or "policy", the rule must say which role or policy to bind to via BindName. Validate() appends this error when those bind types are selected but BindName is empty. (For "management" the inverse applies: BindName should be empty.)

Source

Thrown at nomad/structs/acl.go:2101

	var mErr multierror.Error

	if a.AuthMethod == "" {
		mErr.Errors = append(mErr.Errors, errors.New("auth method is missing"))
	}
	if len(a.Description) > maxACLBindingRuleDescriptionLength {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("description longer than %d", maxACLRoleDescriptionLength))
	}

	// Depending on the bind type, we have some specific validation. Catching
	// the empty string also provides easier to understand feedback to the
	// user.
	switch a.BindType {
	case "":
		mErr.Errors = append(mErr.Errors, errors.New("bind type is missing"))
	case ACLBindingRuleBindTypeRole, ACLBindingRuleBindTypePolicy:
		if a.BindName == "" {
			mErr.Errors = append(mErr.Errors, errors.New("bind name is missing"))
		}
	case ACLBindingRuleBindTypeManagement:
		if a.BindName != "" {
			mErr.Errors = append(mErr.Errors, errors.New("bind name should be empty"))
		}
	default:
		mErr.Errors = append(mErr.Errors, fmt.Errorf("unsupported bind type: %q", a.BindType))
	}

	// If there is a selector configured, ensure that go-bexpr can parse this.
	// Otherwise, the user will get an ambiguous failure when attempting to
	// login.
	if a.Selector != "" {
		if _, err := bexpr.CreateEvaluator(a.Selector, nil); err != nil {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("selector is invalid: %v", err))
		}
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set BindName to the exact name of an existing ACL role or policy
2. If the rule should grant management, switch BindType to "management" and leave BindName empty
3. Verify the target role/policy exists to avoid follow-on reference errors

Example fix

// before
rule := &structs.ACLBindingRule{
  AuthMethod: "okoidc",
  BindType: structs.ACLBindingRuleBindTypePolicy,
}
// after
rule := &structs.ACLBindingRule{
  AuthMethod: "okoidc",
  BindType: structs.ACLBindingRuleBindTypePolicy,
  BindName: "eng-dev",
}

if (rule.BindType == structs.ACLBindingRuleBindTypeRole ||
    rule.BindType == structs.ACLBindingRuleBindTypePolicy) && rule.BindName == "" {
    return errors.New("role/policy binding rules require BindName")
}

if err := rule.Validate(); err != nil {
    if strings.Contains(err.Error(), "bind name is missing") {
        // set rule.BindName (or switch to management type) and resubmit
    }
    return err
}

When it happens

Trigger: ACLBindingRule.Validate() with BindType role or policy and BindName == ""; e.g. nomad acl binding-rule create -type policy without -bind-name.

Common situations: CLI invocations missing the bind-name flag; rename operations that cleared BindName; users assuming management-style rules (which need no name) also apply to role/policy types.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• auth method is missing
• bind type is missing
• bind name should be empty
• ACL auth method lookup failed: %v
• ACL binding rule insert failed: ACL auth method not found

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/674306e45aaf89ea. Report an issue: GitHub.