hashicorp/nomad · error

invalid or missing issuer parameter in callback

Error message

invalid or missing issuer parameter in callback

What it means

When the OIDC provider signals AuthorizationResponseIssParameterSupported, the callback must carry an iss parameter that matches the configured OIDCDiscoveryURL. OIDCCompleteAuth rejects the callback when iss is absent or differs, guarding against issuer-confusion / mix-up attacks between multiple providers.

Source

Thrown at nomad/acl_endpoint.go:2780

	// Use the cache to provide us with an OIDC provider for the auth method
	// that was resolved from state.
	oidcProvider, err := a.oidcProviderCache.Get(authMethod)
	if err != nil {
		return fmt.Errorf("failed to generate OIDC provider: %v", err)
	}

	// Check if the OIDC provider requires the `iss` parameter to be
	// validated
	providerMetadata := struct {
		AuthorizationResponseIssParameterSupported bool `json:"authorization_response_iss_parameter_supported"`
	}{}
	if err := oidcProvider.Claims(&providerMetadata); err != nil {
		return fmt.Errorf("failed to retrieve OIDC provider metadata: %w", err)
	}
	if providerMetadata.AuthorizationResponseIssParameterSupported {
		if args.Iss == "" || args.Iss != authMethod.Config.OIDCDiscoveryURL {
			return errors.New("invalid or missing issuer parameter in callback")
		}
	}

	// Retrieve the request generated in OIDCAuthURL()
	oidcReq := a.oidcRequestCache.LoadAndDelete(args.ClientNonce) // I am so done with this NONCENSE
	if oidcReq == nil {
		// note: this may happen if there is a leader election between getting
		// the auth url and completing the login flow here.
		return errors.New("no OIDC request found for client nonce")
	}

	// Generate a context with a deadline. This is passed to the OIDC provider
	// and used when making remote HTTP requests.
	ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(aclOIDCCallbackRequestExpiryTime))
	defer cancel()

	// Exchange the state and code for an OIDC provider token.
	oidcToken, err := oidcProvider.Exchange(ctx, oidcReq, args.State, args.Code)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Compare the iss value in the callback URL against authMethod.Config.OIDCDiscoveryURL byte-for-byte and fix the discovery URL config (watch trailing slashes and scheme) to match the issuer the provider actually sends.
2. Check the OIDC provider's configuration/docs so it sends the iss authorization-response parameter when it advertises iss support.
3. Re-run the login flow after any config change — an auth started before a discovery-URL change will mismatch.
4. Verify no proxy/redirect step is stripping the iss query parameter from the callback.

Example fix

// before: discovery URL with trailing slash mismatches iss
authMethod.Config.OIDCDiscoveryURL = "https://accounts.example.com/"
// after: match the provider's iss exactly
authMethod.Config.OIDCDiscoveryURL = "https://accounts.example.com"

if providerMetadata.AuthorizationResponseIssParameterSupported {
    iss := callbackQuery.Get("iss")
    if iss == "" || iss != strings.TrimRight(authMethod.Config.OIDCDiscoveryURL, "/") {
        return errors.New("callback issuer does not match configured discovery URL")
    }
}

if err := a.OIDCCompleteAuth(...); err != nil && strings.Contains(err.Error(), "invalid or missing issuer") {
    // log callback iss vs discovery URL and re-initiate the login flow
    return restartOIDCLogin()
}

When it happens

Trigger: OIDCCompleteAuth is called (ACL auth callback) with args.Iss empty, or args.Iss not exactly equal to authMethod.Config.OIDCDiscoveryURL, while provider metadata declares iss-parameter support.

Common situations: OIDC provider omits or misconfigures the iss response parameter; auth method's OIDCDiscoveryURL has a trailing slash or scheme mismatch (https vs http) versus the iss the provider sends; discovery URL changed in config after the auth flow started; registering the same callback with multiple providers.

Related errors

• no auth method config or client assertion
• certificate has expired or is not yet valid
• x5t assertion headers use SHA-1, which is forbidden in FIPS-
• nonce reuse detected
• too many auth requests

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/fda752e158f59137. Report an issue: GitHub.