hashicorp/nomad · error

missing OIDCClientID

Error message

missing OIDCClientID

What it means

Appended by ACLAuthMethodConfig.Validate when the auth method type is OIDC but OIDCClientID is empty; the OIDC flow cannot start without a client ID registered with the identity provider.

Source

Thrown at nomad/structs/acl.go:1588

		// in case KeySource = "client_secret"
		a.OIDCClientAssertion.ClientSecret = a.OIDCClientSecret
		a.OIDCClientAssertion.Canonicalize()
	}
}

func (a *ACLAuthMethodConfig) Validate(methodType string) error {
	if a == nil {
		return errors.New("missing auth method Config")
	}
	mErr := &multierror.Error{}

	switch methodType {
	case ACLAuthMethodTypeOIDC:
		if a.OIDCDiscoveryURL == "" {
			mErr = multierror.Append(mErr, errors.New("missing OIDCDiscoveryURL"))
		}
		if a.OIDCClientID == "" {
			mErr = multierror.Append(mErr, errors.New("missing OIDCClientID"))
		}
		if err := a.OIDCClientAssertion.Validate(); err != nil {
			mErr = multierror.Append(mErr, fmt.Errorf("invalid client assertion config: %w", err))
		}

	case ACLAuthMethodTypeJWT:
		if a.OIDCDiscoveryURL == "" && a.JWKSURL == "" && len(a.JWTValidationPubKeys) == 0 {
			mErr = multierror.Append(mErr, errors.New(
				"JWT auth method requires either OIDCDiscoveryURL, or JWKS URL, or JWTValidationPubKeys set"),
			)
		}
	}

	return helper.FlattenMultierror(mErr)
}

func (a *ACLAuthMethodConfig) Copy() *ACLAuthMethodConfig {
	if a == nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set Config.OIDCClientID to the client ID registered with the OIDC provider
2. Confirm the provider application is created and copy its client ID
3. Check templating/CI variables actually interpolate a non-empty value

Example fix

// before
Config: &api.ACLAuthMethodConfig{OIDCDiscoveryURL: discoveryURL}
// after
Config: &api.ACLAuthMethodConfig{OIDCDiscoveryURL: discoveryURL, OIDCClientID: "nomad-ui"}

func clientIDOK(c *structs.ACLAuthMethodConfig) bool {
  return c != nil && c.OIDCClientID != ""
}

When it happens

Trigger: Upserting an auth method with Type "oidc" whose Config.OIDCClientID is unset/empty.

Common situations: Provider registration done later than Nomad config; copied configs from JWT methods which don't need a client ID; template variables that render to empty string (e.g. unset TF var).

Related errors

• missing OIDCDiscoveryURL
• missing auth method name
• missing client nonce
• missing redirect URI
• missing state

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/42b41cf1b4c1c8d5. Report an issue: GitHub.