hashicorp/nomad · error

missing auth method name

Error message

missing auth method name

What it means

ACLOIDCAuthURLRequest.Validate requires AuthMethodName to be non-empty because the request tells the Nomad server which ACL auth method to start the OIDC login flow against. When AuthMethodName is empty, the server cannot resolve the method, so 'missing auth method name' is appended to the multierror.

Source

Thrown at nomad/structs/acl.go:2331

	// is up to the client to generate this and Go integrations should use the
	// oidc.NewID function within the hashicorp/cap library. This must then be
	// passed back to ACLOIDCCompleteAuthRequest. This is a required parameter.
	ClientNonce string

	// WriteRequest is used due to the requirement by the RPC forwarding
	// mechanism. This request doesn't write anything to Nomad's internal
	// state.
	WriteRequest
}

// Validate ensures the request object contains all the required fields in
// order to start the OIDC authentication flow.
func (a *ACLOIDCAuthURLRequest) Validate() error {

	var mErr multierror.Error

	if a.AuthMethodName == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing auth method name"))
	}
	if a.ClientNonce == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing client nonce"))
	}
	if a.RedirectURI == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing redirect URI"))
	}
	return mErr.ErrorOrNil()
}

// ACLOIDCAuthURLResponse is the response when starting the OIDC authentication
// login flow.
type ACLOIDCAuthURLResponse struct {

	// AuthURL is URL to begin authorization and is where the user logging in
	// should go.
	AuthURL string
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set AuthMethodName to the name of an existing OIDC auth method
2. Run 'nomad acl auth-method list' to get the correct name
3. Provide --auth-method-name (or -method flag) to 'nomad login' explicitly
4. Verify the auth method was not renamed/deleted

Example fix

// before
req := &structs.ACLOIDCAuthURLRequest{RedirectURI: "http://localhost:8000/oidc/callback"}
// after
req := &structs.ACLOIDCAuthURLRequest{AuthMethodName: "auth0", RedirectURI: "http://localhost:8000/oidc/callback"}

func validOIDCAuthURLRequest(req *structs.ACLOIDCAuthURLRequest) bool {
  return req.AuthMethodName != "" && req.ClientNonce != "" && req.RedirectURI != ""
}

func hasAuthMethodName(req *structs.ACLOIDCAuthURLRequest) bool { return req != nil && req.AuthMethodName != "" }

if err := req.Validate(); err != nil {
  var mErr *multierror.Error
  if errors.As(err, &mErr) { /* inspect for 'missing auth method name' and reprompt for method */ }
}

When it happens

Trigger: Calling the OIDC auth-url endpoint (ACL/AuthMethod OIDC login start) with a request whose AuthMethodName field is unset/empty, e.g. nomad acl oidc login without a usable auth-method name resolved from the CLI or API payload.

Common situations: Users running 'nomad login' in a cluster where no default auth method can be inferred; API clients building ACLOIDCAuthURLRequest by hand and forgetting AuthMethodName; auth method deleted/renamed before login.

Related errors

• missing OIDCDiscoveryURL
• missing OIDCClientID
• missing client nonce
• missing redirect URI
• missing state

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/a7e10d3b743bd7bd. Report an issue: GitHub.