hashicorp/nomad · error

failed to generate auth URL: %v

Error message

failed to generate auth URL: %v

What it means

After successfully constructing the OIDC provider, OIDCAuthURL asks it to build the authorization-endpoint redirect URL for the request. If the provider library rejects the request parameters (invalid scope, bad redirect URI, malformed audience/claims), the error is wrapped as 'failed to generate auth URL'.

Source

Thrown at nomad/acl_endpoint.go:2690

	}

	// Use the cache to provide us with an OIDC provider for the auth method
	// that was resolved from state.
	oidcProvider, err := a.oidcProviderCache.Get(authMethod)
	if err != nil {
		return fmt.Errorf("failed to generate OIDC provider: %v", err)
	}

	// Generate a context. This argument is required by the OIDC provider lib,
	// but is not used in any way. This therefore acts for future proofing, if
	// the provider lib uses the context.
	ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(aclOIDCAuthURLRequestExpiryTime))
	defer cancel()

	// Generate the URL, handling any error along with the URL.
	authURL, err := oidcProvider.AuthURL(ctx, oidcReq)
	if err != nil {
		return fmt.Errorf("failed to generate auth URL: %v", err)
	}

	reply.AuthURL = authURL
	return nil
}

// OIDCCompleteAuth complete the OIDC login workflow. It will exchange the OIDC
// provider token for a Nomad ACL token, using the configured ACL role and
// policy claims to provide authorization.
func (a *ACL) OIDCCompleteAuth(
	args *structs.ACLOIDCCompleteAuthRequest, reply *structs.ACLLoginResponse) error {

	// The OIDC flow can only be used when the Nomad cluster has ACL enabled.
	if !a.srv.config.ACLEnabled {
		return aclDisabled
	}

	// Perform the initial forwarding within the region. This ensures we

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check the wrapped error for the exact parameter the IdP/library rejected.
2. Fix the auth method's AllowedRedirectURIs and retry with a matching RedirectURI in the login request.
3. Validate requested Scopes/Audiences against the auth method config (TokenLocality, BoundAudiences, AllowedClaims).
4. Update the IdP application registration to accept Nomad's redirect URI.

Example fix

// before (redirect URI not allowed)
resp, _, err := client.ACL().GetOIDCAuthURL(&api.ACLLoginRequest{AuthMethodName: "okta", RedirectURI: "http://localhost:9999"}, nil)
// -> failed to generate auth URL: ...
// after (register and use an allowed URI)
resp, _, err := client.ACL().GetOIDCAuthURL(&api.ACLLoginRequest{AuthMethodName: "okta", RedirectURI: "http://localhost:9250/oidc/callback"}, nil)

// ensure the redirect URI is registered on the auth method and the IdP app
am, _, err := client.ACL().GetAuthMethod("okta", nil)
if err != nil { return err }
allowed := map[string]bool{}
for _, u := range am.Config.AllowedRedirectURIs { allowed[u] = true }
if !allowed[req.RedirectURI] { return fmt.Errorf("redirect URI %q not in AllowedRedirectURIs", req.RedirectURI) }

func redirectURIAllowed(allowed []string, uri string) bool { for _, a := range allowed { if a == uri { return true } }; return false }

_, _, err := client.ACL().GetOIDCAuthURL(req, nil)
if err != nil && strings.Contains(err.Error(), "failed to generate auth URL") {
    return fmt.Errorf("check RedirectURI/scopes/audiences vs auth method config: %w", err)
}

When it happens

Trigger: Calling OIDCAuthURL with a login request whose RedirectURI is not a valid/allowed URL, whose scopes or audiences conflict with the auth method config, or where the provider's discovery data cannot support the requested parameters.

Common situations: Redirect URI not registered with the IdP; requesting scopes the auth method doesn't allow (SignEphemeral, extra scopes); misconfigured OIDCEndpointAuthParams; wrong client configuration after an IdP change.

Related errors

• missing redirect URI
• failed to generate OIDC provider: %v
• failed to retrieve OIDC provider metadata: %w
• ACL binding rule not found
• ACL auth method not found

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/03588caf45b9162a. Report an issue: GitHub.