hashicorp/nomad · error

failed to make pkce verifier: %w

Error message

failed to make pkce verifier: %w

What it means

Thrown by oidcRequest when capOIDC.NewCodeVerifier() fails to generate a PKCE code verifier while OIDCEnablePKCE is true. The cap library generates a cryptographically random verifier; failure indicates the runtime entropy source or verifier generation constraints failed.

Source

Thrown at nomad/acl_endpoint.go:3136

// oidcRequest builds the request to send to the cap library.
// The way the cap lib is structured, you can build the request once,
// and use it for different request types.
func (a *ACL) oidcRequest(nonce, redirect string, config *structs.ACLAuthMethodConfig) (*capOIDC.Req, error) {
	opts := []capOIDC.Option{
		capOIDC.WithNonce(nonce),
	}

	if len(config.OIDCScopes) > 0 {
		opts = append(opts, capOIDC.WithScopes(config.OIDCScopes...))
	}
	if len(config.BoundAudiences) > 0 {
		opts = append(opts, capOIDC.WithAudiences(config.BoundAudiences...))
	}

	if config.OIDCEnablePKCE {
		verifier, err := capOIDC.NewCodeVerifier()
		if err != nil {
			return nil, fmt.Errorf("failed to make pkce verifier: %w", err)
		}
		opts = append(opts, capOIDC.WithPKCE(verifier))
	}

	if config.OIDCClientAssertion.IsSet() {
		j, err := a.oidcClientAssertion(config)
		if err != nil {
			return nil, err
		}
		opts = append(opts, capOIDC.WithClientAssertionJWT(j))
	}

	req, err := capOIDC.NewRequest(
		aclOIDCAuthURLRequestExpiryTime,
		redirect,
		opts...,
	)
	if err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify /dev/urandom (crypto/rand) is available and not exhausted on the Nomad server host.
2. Check the host container/seccomp policy is not blocking getrandom(2).
3. Restart the Nomad server agent and retry the OIDC login.
4. If PKCE is not required by the IdP, disable OIDCEnablePKCE as a workaround.

Example fix

// before
"OIDCEnablePKCE": true
// after (only if IdP supports PKCE properly and entropy issue is host-side, fix host; or disable)
"OIDCEnablePKCE": false

verifier, err := capOIDC.NewCodeVerifier()
if err != nil {
    return nil, fmt.Errorf("failed to make pkce verifier: %w", err)
}

When it happens

Trigger: config.OIDCEnablePKCE is true and capOIDC.NewCodeVerifier() returns an error — effectively only on systems where crypto/rand fails (entropy exhaustion, sandboxed/containers with restricted /dev/urandom).

Common situations: Running Nomad servers in restricted containers or VMs with a depleted entropy pool; corrupted Go crypto runtime. Extremely rare in practice.

Related errors

• no auth method config or client assertion
• missing OIDCDiscoveryURL
• missing OIDCClientID
• missing Audience
• PrivateKey is required for `private_key` KeySource

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/c8cf4ced604a5c75. Report an issue: GitHub.