hashicorp/nomad · error

failed to create OIDC request

Error message

failed to create OIDC request: %v

What it means

Thrown by oidcRequest when capOIDC.NewRequest fails to construct the OIDC auth request object that carries the expiry, redirect URI, and options (scopes, audiences, PKCE verifier, client assertion). The wrapped error explains which option or parameter the cap library rejected.

Solutions

1. Read the wrapped cause to see which parameter cap rejected.
2. Verify AllowedRedirectURIs in the auth method config are absolute, well-formed URLs and match the callback exactly.
3. Check BoundAudiences, OIDCScopes, and OIDCClientAssertion fields for empty/malformed values.
4. Upgrade Nomad / cap library if the error stems from a cap validation bug.

Example fix

// before
"AllowedRedirectURIs": ["ui/oidc/callback"]
// after
"AllowedRedirectURIs": ["https://nomad.example.com/ui/oidc/callback","https://nomad.example.com/oauth2/oidc/callback"]

// validate auth-method config before calling the auth URL endpoint
u, err := url.Parse(method.Config.AllowedRedirectURIs[0])
if err != nil || !u.IsAbs() { return errors.New("redirect URI must be absolute") }
if len(method.Config.BoundAudiences) == 0 && len(method.Config.BoundClaims) == 0 {
  return errors.New("need BoundAudiences or BoundClaims")
}

req, err := capOIDC.NewRequest(expiry, redirect, opts...)
if err != nil {
    return nil, fmt.Errorf("failed to create OIDC request: %v", err)
}

When it happens

Trigger: capOIDC.NewRequest(aclOIDCAuthURLRequestExpiryTime, redirect, opts...) returns an error: invalid redirect URI format, invalid expiry, or one of the accumulated opts (audiences, scopes, PKCE verifier, client assertion JWT) is malformed.

Common situations: Misconfigured AllowedRedirectURIs producing a bad redirect value, invalid BoundAudiences or OIDCScopes entries, a client assertion JWT built with bad key material passed via WithClientAssertion.

Related errors

• AdvertiseAddrs is nil or empty
• all servers should be running version
• All templates should have same Once value
• artifact must not be nil
• can only use change_signal=

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/2778c51e00507cbe. Report an issue: GitHub.

Appendix: source

Thrown at nomad/acl_endpoint.go:3155

		}
		opts = append(opts, capOIDC.WithPKCE(verifier))
	}

	if config.OIDCClientAssertion.IsSet() {
		j, err := a.oidcClientAssertion(config)
		if err != nil {
			return nil, err
		}
		opts = append(opts, capOIDC.WithClientAssertionJWT(j))
	}

	req, err := capOIDC.NewRequest(
		aclOIDCAuthURLRequestExpiryTime,
		redirect,
		opts...,
	)
	if err != nil {
		return nil, fmt.Errorf("failed to create OIDC request: %v", err)
	}

	return req, nil
}

func (a *ACL) oidcClientAssertion(config *structs.ACLAuthMethodConfig) (*cass.JWT, error) {
	// this nomad key will only actually be used if the client assertion config
	// KeySource = "nomad", but we get it here to avoid exposing more of the
	// codebase to the encrypter.
	nomadKey, nomadKID, err := a.srv.encrypter.GetActiveKey()
	if err != nil {
		return nil, fmt.Errorf("failed to get active nomad key: %w", err)
	}
	j, err := oidc.BuildClientAssertionJWT(config, nomadKey, nomadKID)
	if err != nil {
		return nil, fmt.Errorf("failed to build client_assertion jwt: %w", err)
	}
	if config.VerboseLogging {

View on GitHub (pinned to 482b49bf1a)