What causes "error storing OIDC request: %w" in hashicorp/nomad?

Check connectivity and health of the backing state store (e.g. redis/consul endpoint in config)

error storing OIDC request: %w

Error message

error storing OIDC request: %w

What it means

LoadOrAdd atomically loads a cached oidc request or creates one via create(); after creating, it persists the request with storeLocked. This error wraps any failure from that store write (e.g. backend connection failure, serialization error, lock contention). The OIDC request could not be cached, so the auth flow aborts.

Source

Thrown at lib/auth/oidc/request.go:97

	return nil
}

// LoadOrAdd atomically fetches a previously cached oidc.Req or creates once
// using the provided function and stores it before returning it. If
// LoadAndDelete is not called later, the stale request will eventually expire
// and be auto-deleted.
func (rc *RequestCache) LoadOrAdd(clientNonce string, create func() (*oidc.Req, error)) (*oidc.Req, error) {
	rc.lock.Lock()
	defer rc.lock.Unlock()
	var err error
	oidcReq := rc.loadLocked(clientNonce)
	if oidcReq == nil {
		oidcReq, err = create()
		if err != nil {
			return nil, err
		}
		if err = rc.storeLocked(oidcReq); err != nil {
			return nil, fmt.Errorf("error storing OIDC request: %w", err)
		}
	}
	return oidcReq, nil
}

// LoadAndDelete atomically loads a previously-cache oidc.Req and clears it from
// the cache
func (rc *RequestCache) LoadAndDelete(nonce string) *oidc.Req {
	rc.lock.Lock()
	defer rc.lock.Unlock()
	if req, ok := rc.c.Get(nonce); ok {
		rc.c.Remove(nonce)
		return req
	}
	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

Check connectivity and health of the backing state store (e.g. redis/consul endpoint in config)
Inspect the wrapped error (%w) for the root cause — timeout vs connection refused vs serialization
Retry the OIDC auth URL generation; the failure is typically transient
If persistent, verify store credentials, size limits, and lock configuration

Defensive patterns

Strategy: retry

Validate before calling

// Pre-check store reachability before starting the OIDC flow
if err := store.Ping(ctx); err != nil {
	return fmt.Errorf("OIDC request store unreachable: %w", err)
}

Try / catch

oidcReq, err := cache.LoadOrAdd(ctx, key, create)
if err != nil {
	if strings.Contains(err.Error(), "error storing OIDC request") {
		// inspect wrapped cause; transient store failure — retry with backoff
		return retryWithBackoff(func() error {
			_, err := cache.LoadOrAdd(ctx, key, create)
			return err
		})
	}
	return err
}

Prevention

Monitor the backing state store's health and alerts
Set sane store timeouts and connection-pool limits
Keep serialized OIDC requests small to avoid store size limits
Retry idempotent LoadOrAdd calls on transient store errors

When it happens

Trigger: OIDCAuthURL or cacheOIDCRequest calls LoadOrAdd, the request is not yet cached (cache miss), create() succeeds, but rc.storeLocked writes to the backing store fails — Redis/consul store down, timeout, or lock acquisition failure.

Common situations: Backend cache service unreachable or restarted mid-flow; network partition between Nomad and the state store; store size limits rejecting the serialized request; expired/lost distributed lock.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/351965c7c918f551. Report an issue: GitHub.