hashicorp/nomad · error

failed to generate ACL token name: %w

Error message

failed to generate ACL token name: %w

What it means

Thrown by formatTokenName when InterpolateHIL fails to render the auth method's token_name_format template against the mapped claims. The format string uses HIL interpolation over claim mappings, so a malformed template or a reference to a claim key that does not exist causes this error.

Source

Thrown at nomad/acl_endpoint.go:3112

	return nil
}

func formatTokenName(format, authType, authName string, claims map[string]string) (string, error) {
	claimMappings := map[string]string{
		"auth_method_type": authType,
		"auth_method_name": authName,
	}
	for k, v := range claims {
		claimMappings["value."+k] = v
	}

	if format == "" {
		format = structs.DefaultACLAuthMethodTokenNameFormat
	}
	tokenName, err := auth.InterpolateHIL(format, claimMappings, false)
	if err != nil {
		return "", fmt.Errorf("failed to generate ACL token name: %w", err)
	}

	return tokenName, nil
}

// oidcRequest builds the request to send to the cap library.
// The way the cap lib is structured, you can build the request once,
// and use it for different request types.
func (a *ACL) oidcRequest(nonce, redirect string, config *structs.ACLAuthMethodConfig) (*capOIDC.Req, error) {
	opts := []capOIDC.Option{
		capOIDC.WithNonce(nonce),
	}

	if len(config.OIDCScopes) > 0 {
		opts = append(opts, capOIDC.WithScopes(config.OIDCScopes...))
	}
	if len(config.BoundAudiences) > 0 {
		opts = append(opts, capOIDC.WithAudiences(config.BoundAudiences...))

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check the wrapped HIL error: fix the template syntax (balanced {{...}} delimiters) in token_name_format.
2. Ensure every variable referenced in token_name_format exists in claim_mappings and that the IdP actually emits that claim for the logging-in user.
3. Add a fallback literal or a default so the format never references an optional claim directly.
4. Temporarily unset token_name_format to use DefaultACLAuthMethodTokenNameFormat and confirm the rest of the flow works.

Example fix

// before
"token_name_format": "{{user.email}}-token"
// after: guarantee the claim is mapped / provide safe format
"claim_mappings": { "email": "user.email" },
"token_name_format": "{{user.email}}-token"

// validate token_name_format variables against claim_mappings before Upsert
for _, v := range extractHILVars(method.Config.TokenNameFormat) {
  if _, ok := method.Config.ClaimMappings[v]; !ok {
    return fmt.Errorf("token_name_format references unmapped claim %q", v)
  }
}

name, err := auth.InterpolateHIL(format, claimMappings, false)
if err != nil {
    return "", fmt.Errorf("failed to generate ACL token name: %w", err)
}

When it happens

Trigger: formatTokenName is called from OIDCCompleteAuth or Login and auth.InterpolateHIL(format, claimMappings, false) returns an error — usually a syntactically bad template or missing interpolation variable.

Common situations: token_name_format references a claim (e.g. {{user.email}}) that the IdP never provides or that was not mapped in claim_mappings, unbalanced braces, or special characters the HIL parser rejects.

Related errors

• template source path escapes alloc directory
• template destination path escapes alloc directory
• ACL policy not found
• ACL role not found
• detected corrupted token within the state store: missing rol

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/fcc601dc7459a601. Report an issue: GitHub.