hashicorp/nomad · error

missing OIDCDiscoveryURL

Error message

missing OIDCDiscoveryURL

What it means

For OIDC auth methods, the discovery URL is mandatory: it tells Nomad where to fetch the provider's OpenID configuration. ACLAuthMethodConfig.Validate emits this error when methodType is OIDC but OIDCDiscoveryURL is empty.

Source

Thrown at nomad/structs/acl.go:1585

			a.OIDCClientAssertion.Audience = []string{a.OIDCDiscoveryURL}
		}
		// the client assertion inherits the client secret,
		// in case KeySource = "client_secret"
		a.OIDCClientAssertion.ClientSecret = a.OIDCClientSecret
		a.OIDCClientAssertion.Canonicalize()
	}
}

func (a *ACLAuthMethodConfig) Validate(methodType string) error {
	if a == nil {
		return errors.New("missing auth method Config")
	}
	mErr := &multierror.Error{}

	switch methodType {
	case ACLAuthMethodTypeOIDC:
		if a.OIDCDiscoveryURL == "" {
			mErr = multierror.Append(mErr, errors.New("missing OIDCDiscoveryURL"))
		}
		if a.OIDCClientID == "" {
			mErr = multierror.Append(mErr, errors.New("missing OIDCClientID"))
		}
		if err := a.OIDCClientAssertion.Validate(); err != nil {
			mErr = multierror.Append(mErr, fmt.Errorf("invalid client assertion config: %w", err))
		}

	case ACLAuthMethodTypeJWT:
		if a.OIDCDiscoveryURL == "" && a.JWKSURL == "" && len(a.JWTValidationPubKeys) == 0 {
			mErr = multierror.Append(mErr, errors.New(
				"JWT auth method requires either OIDCDiscoveryURL, or JWKS URL, or JWTValidationPubKeys set"),
			)
		}
	}

	return helper.FlattenMultierror(mErr)
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set Config.OIDCDiscoveryURL to the provider's issuer/https discovery endpoint before submitting
2. Verify the method Type is OIDC and matches the config fields you supplied

Example fix

// before
cfg := &api.ACLAuthMethodConfig{OIDCClientID: "nomad"}
// after
cfg := &api.ACLAuthMethodConfig{OIDCDiscoveryURL: "https://accounts.google.com", OIDCClientID: "nomad"}

func oidcConfigOK(c *structs.ACLAuthMethodConfig) bool {
  return c != nil && c.OIDCDiscoveryURL != "" && c.OIDCClientID != ""
}

When it happens

Trigger: Upserting an auth method with Type "oidc" and Config lacking OIDCDiscoveryURL.

Common situations: Typos like discovery_url vs OIDCDiscoveryURL in API payloads; copying a JWT auth method config into an OIDC method; partially filled configs during terraform/CI provisioning.

Related errors

• missing OIDCClientID
• missing auth method name
• missing client nonce
• missing redirect URI
• missing state

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4a835621b32ffa4e. Report an issue: GitHub.