hashicorp/nomad · error

missing code

Error message

missing code

What it means

ACLOIDCCompleteAuthRequest.Validate requires Code to be non-empty. The authorization code returned by the OIDC provider is what Nomad exchanges (with the provider) for tokens to complete login. An empty Code yields 'missing code'.

Source

Thrown at nomad/structs/acl.go:2390

}

// Validate ensures the request object contains all the required fields in
// order to complete the OIDC authentication flow.
func (a *ACLOIDCCompleteAuthRequest) Validate() error {

	var mErr multierror.Error

	if a.AuthMethodName == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing auth method name"))
	}
	if a.ClientNonce == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing client nonce"))
	}
	if a.State == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing state"))
	}
	if a.Code == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing code"))
	}
	if a.RedirectURI == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing redirect URI"))
	}
	return mErr.ErrorOrNil()
}

// ACLLoginResponse is the response when the auth flow has been
// completed successfully.
type ACLLoginResponse struct {
	ACLToken *ACLToken
	WriteMeta
}

// ACLLoginRequest is the request object to begin auth with an external
// token provider.
type ACLLoginRequest struct {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check the callback for an error parameter and abort if no code was issued
2. Parse the code query parameter correctly and set Code on the request
3. Handle provider error redirects (access_denied, etc.) with a user-facing message instead of calling the API

Example fix

// before
q := r.URL.Query()
req := &structs.ACLOIDCCompleteAuthRequest{...}
// after
q := r.URL.Query()
if q.Get("error") != "" { return q.Get("error") }
req := &structs.ACLOIDCCompleteAuthRequest{Code: q.Get("code"), ...}

if req.Code == "" { return errors.New("Authorization code missing from callback; check for provider error response") }

func hasCode(req *structs.ACLOIDCCompleteAuthRequest) bool { return req != nil && req.Code != "" }

if err := req.Validate(); err != nil {
  if strings.Contains(err.Error(), "missing code") { /* surface provider error to user instead of retrying */ }
}

When it happens

Trigger: Calling the OIDC complete-auth endpoint with ACLOIDCCompleteAuthRequest.Code == "", e.g. the callback fired with an error response from the provider (no code parameter) but the client still submits the request.

Common situations: User denies consent at the IdP so no code is issued; provider redirect error handled by submitting the request anyway; callback URL parsing mistakes dropping the code parameter.

Related errors

• missing OIDCDiscoveryURL
• missing OIDCClientID
• missing auth method name
• missing client nonce
• missing redirect URI

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/9b18bd82ff5376f6. Report an issue: GitHub.