hashicorp/nomad · error

JWT auth method requires either OIDCDiscoveryURL, or JWKS UR

Error message

JWT auth method requires either OIDCDiscoveryURL, or JWKS URL, or JWTValidationPubKeys set

What it means

ACLAuthMethodConfig.Validate rule for JWT methods: none of OIDCDiscoveryURL, JWKSURL, or JWTValidationPubKeys is set, so Nomad has no way to obtain verification keys for the JWTs and cannot validate signatures.

Source

Thrown at nomad/structs/acl.go:1596

		return errors.New("missing auth method Config")
	}
	mErr := &multierror.Error{}

	switch methodType {
	case ACLAuthMethodTypeOIDC:
		if a.OIDCDiscoveryURL == "" {
			mErr = multierror.Append(mErr, errors.New("missing OIDCDiscoveryURL"))
		}
		if a.OIDCClientID == "" {
			mErr = multierror.Append(mErr, errors.New("missing OIDCClientID"))
		}
		if err := a.OIDCClientAssertion.Validate(); err != nil {
			mErr = multierror.Append(mErr, fmt.Errorf("invalid client assertion config: %w", err))
		}

	case ACLAuthMethodTypeJWT:
		if a.OIDCDiscoveryURL == "" && a.JWKSURL == "" && len(a.JWTValidationPubKeys) == 0 {
			mErr = multierror.Append(mErr, errors.New(
				"JWT auth method requires either OIDCDiscoveryURL, or JWKS URL, or JWTValidationPubKeys set"),
			)
		}
	}

	return helper.FlattenMultierror(mErr)
}

func (a *ACLAuthMethodConfig) Copy() *ACLAuthMethodConfig {
	if a == nil {
		return nil
	}

	c := new(ACLAuthMethodConfig)
	*c = *a

	c.JWTValidationPubKeys = slices.Clone(a.JWTValidationPubKeys)
	c.OIDCScopes = slices.Clone(a.OIDCScopes)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set Config.JWKSURL to the provider's JWKS endpoint (most common for external JWT issuers)
2. Or set OIDCDiscoveryURL if the issuer supports OIDC discovery
3. Or provide Config.JWTValidationPubKeys with one or more PEM public keys

Example fix

// before
Config: &api.ACLAuthMethodConfig{BoundAudiences: ["nomad"]}
// after
Config: &api.ACLAuthMethodConfig{BoundAudiences: ["nomad"], JWKSURL: "https://example.com/.well-known/jwks.json"}

func jwtValidationSourceSet(c *structs.ACLAuthMethodConfig) bool {
  return c != nil && (c.OIDCDiscoveryURL != "" || c.JWKSURL != "" || len(c.JWTValidationPubKeys) > 0)
}

When it happens

Trigger: Upserting an auth method with Type "jwt" while OIDCDiscoveryURL, JWKSURL, and JWTValidationPubKeys are all empty.

Common situations: JWT method created as a placeholder before keys were provisioned; typo'd field names in JSON payloads; teams deleting pubkeys during rotation without adding a JWKS URL first.

Related errors

• invalid config: %w
• %w; key header for key ID must be %q
• %w; certificate-derived key header must be one of: %q, %q
• token name too long
• client token missing policies or roles

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/40ce707b5a1c08a5. Report an issue: GitHub.