hashicorp/nomad · error

missing Audience

Error message

missing Audience

What it means

When an OIDC client assertion is configured, its Audience list must be non-empty and the first entry non-blank — the audience identifies the intended token recipient (the IdP token endpoint). OIDCClientAssertion.Validate returns this error otherwise.

Source

Thrown at nomad/structs/acl.go:1772

		case OIDCKeySourceClientSecret:
			c.KeyAlgorithm = "HS256"
		case OIDCKeySourceNomad, OIDCKeySourcePrivateKey:
			c.KeyAlgorithm = "RS256"
		}
	}
	c.PrivateKey.Canonicalize()
}

func (c *OIDCClientAssertion) IsSet() bool {
	return c != nil && c.KeySource != ""
}

func (c *OIDCClientAssertion) Validate() error {
	if c == nil {
		return nil
	}
	if len(c.Audience) == 0 || c.Audience[0] == "" {
		return errors.New("missing Audience")
	}
	switch c.KeySource {
	case OIDCKeySourceNomad:
	case OIDCKeySourcePrivateKey:
		if c.PrivateKey == nil {
			return errors.New("PrivateKey is required for `private_key` KeySource")
		}
		if err := c.PrivateKey.Validate(); err != nil {
			return fmt.Errorf("invalid PrivateKey: %w", err)
		}
	case OIDCKeySourceClientSecret:
		if c.ClientSecret == "" {
			return errors.New("OIDCClientSecret is required for `client_secret` KeySource")
		}
	default:
		return fmt.Errorf("invalid KeySource %q", c.KeySource)
	}
	return nil

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set Audience to at least one value, typically the OIDC issuer or token endpoint URL the IdP expects
2. Ensure the first audience element is a non-empty string

Example fix

// before
assertion := &api.OIDCClientAssertion{KeySource: "nomad"}
// after
assertion := &api.OIDCClientAssertion{KeySource: "nomad", Audience: ["https://issuer.example.com"]}

func assertionAudienceOK(c *structs.OIDCClientAssertion) bool {
  return c == nil || (len(c.Audience) > 0 && c.Audience[0] != "")
}

When it happens

Trigger: Setting Config.OIDCClientAssertion without Audience, with an empty list, or with [""] as the first element, then upserting the auth method or using private_key_jwt authentication.

Common situations: Partial private_key_jwt setups where key material is configured but the required audience (usually the issuer or token endpoint URL) is omitted; copy-pasted assertion blocks with placeholder audience removed.

Related errors

• PrivateKey is required for `private_key` KeySource
• invalid config: %w
• %w; key header for key ID must be %q
• %w; certificate-derived key header must be one of: %q, %q
• no auth method config or client assertion

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/6f343cb9cfd09776. Report an issue: GitHub.