hashicorp/nomad · error

missing auth method Config

Error message

missing auth method Config

What it means

ACLAuthMethodConfig.Validate is called with the method's type; if the Config struct itself is nil there is nothing to validate, so it returns this error. The auth method was declared but its configuration block is absent.

Source

Thrown at nomad/structs/acl.go:1578

func (a *ACLAuthMethodConfig) Canonicalize() {
	if a == nil {
		return
	}
	if a.OIDCClientAssertion != nil {
		// client assertions inherit certain values from auth method
		if len(a.OIDCClientAssertion.Audience) == 0 {
			a.OIDCClientAssertion.Audience = []string{a.OIDCDiscoveryURL}
		}
		// the client assertion inherits the client secret,
		// in case KeySource = "client_secret"
		a.OIDCClientAssertion.ClientSecret = a.OIDCClientSecret
		a.OIDCClientAssertion.Canonicalize()
	}
}

func (a *ACLAuthMethodConfig) Validate(methodType string) error {
	if a == nil {
		return errors.New("missing auth method Config")
	}
	mErr := &multierror.Error{}

	switch methodType {
	case ACLAuthMethodTypeOIDC:
		if a.OIDCDiscoveryURL == "" {
			mErr = multierror.Append(mErr, errors.New("missing OIDCDiscoveryURL"))
		}
		if a.OIDCClientID == "" {
			mErr = multierror.Append(mErr, errors.New("missing OIDCClientID"))
		}
		if err := a.OIDCClientAssertion.Validate(); err != nil {
			mErr = multierror.Append(mErr, fmt.Errorf("invalid client assertion config: %w", err))
		}

	case ACLAuthMethodTypeJWT:
		if a.OIDCDiscoveryURL == "" && a.JWKSURL == "" && len(a.JWTValidationPubKeys) == 0 {
			mErr = multierror.Append(mErr, errors.New(

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Populate the auth method's Config, including OIDCDiscoveryURL/OIDCClientID (OIDC) or a validation source (JWT)
2. If the method intentionally has no config, it cannot use OIDC/JWT types — use a type that does not require Config

Example fix

// before
method := &api.ACLAuthMethod{Name: "okta", Type: "oidc"}
// after
method := &api.ACLAuthMethod{Name: "okta", Type: "oidc",
  Config: &api.ACLAuthMethodConfig{OIDCDiscoveryURL: "https://issuer", OIDCClientID: "nomad"}}

if method.Type == "oidc" && method.Config == nil {
  return errors.New("auth method of type oidc requires a config block")
}

When it happens

Trigger: Creating/updating an OIDC or JWT auth method (ACL.UpsertACLAuthMethods) without a Config, or with an explicitly nil Config, so the server passes nil into ACLAuthMethodConfig.Validate(methodType).

Common situations: HCL/JSON auth method stanzas missing the config block; API clients that build ACLAuthMethod without instantiating Config; upgrades where an older method definition lacks the newly required config section.

Related errors

• ACL binding rule not found
• ACL auth method not found
• token name too long
• client token missing policies or roles
• management token cannot be associated with policies or roles

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/e73bcf2a8b849a5a. Report an issue: GitHub.