hashicorp/nomad · error

failed to create OIDC request: %v

Error message

failed to create OIDC request: %v

What it means

Thrown by oidcRequest when capOIDC.NewRequest fails to construct the OIDC auth request object that carries the expiry, redirect URI, and options (scopes, audiences, PKCE verifier, client assertion). The wrapped error explains which option or parameter the cap library rejected.

Source

Thrown at nomad/acl_endpoint.go:3155

		}
		opts = append(opts, capOIDC.WithPKCE(verifier))
	}

	if config.OIDCClientAssertion.IsSet() {
		j, err := a.oidcClientAssertion(config)
		if err != nil {
			return nil, err
		}
		opts = append(opts, capOIDC.WithClientAssertionJWT(j))
	}

	req, err := capOIDC.NewRequest(
		aclOIDCAuthURLRequestExpiryTime,
		redirect,
		opts...,
	)
	if err != nil {
		return nil, fmt.Errorf("failed to create OIDC request: %v", err)
	}

	return req, nil
}

func (a *ACL) oidcClientAssertion(config *structs.ACLAuthMethodConfig) (*cass.JWT, error) {
	// this nomad key will only actually be used if the client assertion config
	// KeySource = "nomad", but we get it here to avoid exposing more of the
	// codebase to the encrypter.
	nomadKey, nomadKID, err := a.srv.encrypter.GetActiveKey()
	if err != nil {
		return nil, fmt.Errorf("failed to get active nomad key: %w", err)
	}
	j, err := oidc.BuildClientAssertionJWT(config, nomadKey, nomadKID)
	if err != nil {
		return nil, fmt.Errorf("failed to build client_assertion jwt: %w", err)
	}
	if config.VerboseLogging {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Read the wrapped cause to see which parameter cap rejected.
2. Verify AllowedRedirectURIs in the auth method config are absolute, well-formed URLs and match the callback exactly.
3. Check BoundAudiences, OIDCScopes, and OIDCClientAssertion fields for empty/malformed values.
4. Upgrade Nomad / cap library if the error stems from a cap validation bug.

Example fix

// before
"AllowedRedirectURIs": ["ui/oidc/callback"]
// after
"AllowedRedirectURIs": ["https://nomad.example.com/ui/oidc/callback","https://nomad.example.com/oauth2/oidc/callback"]

// validate auth-method config before calling the auth URL endpoint
u, err := url.Parse(method.Config.AllowedRedirectURIs[0])
if err != nil || !u.IsAbs() { return errors.New("redirect URI must be absolute") }
if len(method.Config.BoundAudiences) == 0 && len(method.Config.BoundClaims) == 0 {
  return errors.New("need BoundAudiences or BoundClaims")
}

req, err := capOIDC.NewRequest(expiry, redirect, opts...)
if err != nil {
    return nil, fmt.Errorf("failed to create OIDC request: %v", err)
}

When it happens

Trigger: capOIDC.NewRequest(aclOIDCAuthURLRequestExpiryTime, redirect, opts...) returns an error: invalid redirect URI format, invalid expiry, or one of the accumulated opts (audiences, scopes, PKCE verifier, client assertion JWT) is malformed.

Common situations: Misconfigured AllowedRedirectURIs producing a bad redirect value, invalid BoundAudiences or OIDCScopes entries, a client assertion JWT built with bad key material passed via WithClientAssertion.

Related errors

• plugin not found
• wait config is nil or empty
• wait config is empty
• no auth method config or client assertion
• missing OIDCDiscoveryURL

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/2778c51e00507cbe. Report an issue: GitHub.