hashicorp/nomad · error

failed to generate OIDC provider: %v

Error message

failed to generate OIDC provider: %v

What it means

During OIDCAuthURL, Nomad builds a go-oidc/OpenIDConnect provider object from the auth method's OIDC discovery configuration via the oidcProviderCache. If the provider cannot be constructed (discovery URL unreachable, invalid TLS, malformed discovery document, bad client config), the underlying error is wrapped as 'failed to generate OIDC provider'.

Source

Thrown at nomad/acl_endpoint.go:2678

		args.Region = a.srv.config.AuthoritativeRegion

		if done, err := a.srv.forward(structs.ACLOIDCAuthURLRPCMethod, args, args, reply); done {
			return err
		}
	}

	oidcReq, err := a.oidcRequestCache.LoadOrAdd(args.ClientNonce, func() (*capOIDC.Req, error) {
		return a.oidcRequest(args.ClientNonce, args.RedirectURI, authMethod.Config)
	})
	if err != nil {
		return err
	}

	// Use the cache to provide us with an OIDC provider for the auth method
	// that was resolved from state.
	oidcProvider, err := a.oidcProviderCache.Get(authMethod)
	if err != nil {
		return fmt.Errorf("failed to generate OIDC provider: %v", err)
	}

	// Generate a context. This argument is required by the OIDC provider lib,
	// but is not used in any way. This therefore acts for future proofing, if
	// the provider lib uses the context.
	ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(aclOIDCAuthURLRequestExpiryTime))
	defer cancel()

	// Generate the URL, handling any error along with the URL.
	authURL, err := oidcProvider.AuthURL(ctx, oidcReq)
	if err != nil {
		return fmt.Errorf("failed to generate auth URL: %v", err)
	}

	reply.AuthURL = authURL
	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Fix the auth method's OIDCDiscoveryURL and verify it is reachable from the Nomad servers (curl <url>/.well-known/openid-configuration).
2. Check the full wrapped error message for the root cause (DNS, TLS, 404, malformed JSON).
3. Ensure the IdP hostname's TLS chain is trusted by Nomad servers or install the CA cert.
4. Re-run 'nomad acl auth-method update' with corrected config, then retry 'nomad login'.

Example fix

// before
authMethod := &api.ACLAuthMethod{Name: "okta", Type: "oidc", Config: &api.ACLAuthMethodConfig{OIDCDiscoveryURL: "https://okta.example.com/wrong", OIDCClientID: cid, BoundAudiences: []string{cid}}}
// after
authMethod := &api.ACLAuthMethod{Name: "okta", Type: "oidc", Config: &api.ACLAuthMethodConfig{OIDCDiscoveryURL: "https://your-org.okta.com/oauth2/default", OIDCClientID: cid, BoundAudiences: []string{cid}}}

cfg, _, err := client.ACL().GetAuthMethod("okta", nil)
if err != nil { return err }
resp, err := http.Get(cfg.Config.OIDCDiscoveryURL + "/.well-known/openid-configuration")
if err != nil { return fmt.Errorf("IdP unreachable from this host: %w", err) }
if resp.StatusCode != 200 { return fmt.Errorf("discovery returned %d", resp.StatusCode) }

func validDiscoveryURL(cfg *api.ACLAuthMethodConfig) bool {
    if cfg == nil || cfg.OIDCDiscoveryURL == "" { return false }
    u, err := url.Parse(cfg.OIDCDiscoveryURL)
    return err == nil && (u.Scheme == "https" || u.Scheme == "http") && u.Host != ""
}

_, _, err := client.ACL().GetOIDCAuthURL(req, nil)
if err != nil && strings.Contains(err.Error(), "failed to generate OIDC provider") {
    // root cause is in the wrapped text: DNS, TLS, or bad discovery doc
    return fmt.Errorf("check auth method %q OIDCDiscoveryURL/reachability: %w", req.AuthMethodName, err)
}

When it happens

Trigger: Calling OIDCAuthURL ('nomad login -method=...') where the auth method's OIDCDiscoveryURL is wrong/unreachable, uses bad TLS certs, points to a non-OIDC endpoint, or has an invalid client_id/client_secret/audience pair.

Common situations: Typo in the discovery URL; internal OIDC provider behind a firewall not reachable from the servers; self-signed certificates not trusted; IdP discovery document missing required fields; auth method updated after the IdP endpoint changed.

Related errors

• failed to generate auth URL: %v
• failed to retrieve OIDC provider metadata: %w
• ACL binding rule not found
• ACL auth method not found
• missing auth method Config

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/ed5dcf2f825ab3af. Report an issue: GitHub.