hashicorp/nomad · error

missing client nonce

Error message

missing client nonce

What it means

ACLOIDCAuthURLRequest.Validate requires ClientNonce to be non-empty. The nonce ties the generated OIDC auth URL to a client session so the callback can be verified against the original request. An empty nonce means the flow cannot be validated, so 'missing client nonce' is appended.

Source

Thrown at nomad/structs/acl.go:2334

	ClientNonce string

	// WriteRequest is used due to the requirement by the RPC forwarding
	// mechanism. This request doesn't write anything to Nomad's internal
	// state.
	WriteRequest
}

// Validate ensures the request object contains all the required fields in
// order to start the OIDC authentication flow.
func (a *ACLOIDCAuthURLRequest) Validate() error {

	var mErr multierror.Error

	if a.AuthMethodName == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing auth method name"))
	}
	if a.ClientNonce == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing client nonce"))
	}
	if a.RedirectURI == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing redirect URI"))
	}
	return mErr.ErrorOrNil()
}

// ACLOIDCAuthURLResponse is the response when starting the OIDC authentication
// login flow.
type ACLOIDCAuthURLResponse struct {

	// AuthURL is URL to begin authorization and is where the user logging in
	// should go.
	AuthURL string
}

// ACLOIDCCompleteAuthRequest is the request object to begin completing the
// OIDC auth cycle after receiving the callback from the OIDC provider.

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Generate a secure random nonce (e.g. uuid) and set ClientNonce before the request
2. Reuse the Nomad CLI's login flow instead of hand-rolling the auth-url call
3. Ensure the same nonce is supplied when completing the flow

Example fix

// before
req := &structs.ACLOIDCAuthURLRequest{AuthMethodName: "auth0", RedirectURI: redirect}
// after
req := &structs.ACLOIDCAuthURLRequest{AuthMethodName: "auth0", RedirectURI: redirect, ClientNonce: uuid.Generate()}

if req.ClientNonce == "" { return errors.New("ClientNonce must be a generated random nonce") }

func hasNonce(req *structs.ACLOIDCAuthURLRequest) bool { return req != nil && req.ClientNonce != "" }

if err := req.Validate(); err != nil {
  if strings.Contains(err.Error(), "missing client nonce") {
    req.ClientNonce = uuid.Generate() // regenerate and retry once
  }
}

When it happens

Trigger: Calling the OIDC auth-url endpoint with ACLOIDCAuthURLRequest.ClientNonce == "", e.g. an API client that builds the request manually without generating a nonce (the Nomad CLI normally generates one).

Common situations: Custom OIDC login tooling against Nomad's HTTP API omitting ClientNonce; reusing CLI code paths but dropping nonce generation; test harnesses constructing partial requests.

Related errors

• missing OIDCDiscoveryURL
• missing OIDCClientID
• missing auth method name
• missing redirect URI
• missing state

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/27d76318c4c7a981. Report an issue: GitHub.