hashicorp/nomad · error

missing redirect URI

Error message

missing redirect URI

What it means

ACLOIDCAuthURLRequest.Validate requires RedirectURI to be non-empty. The redirect URI is where the OIDC provider sends the user after authentication and must match the provider's registered callback. An empty RedirectURI makes the auth URL impossible to construct, so 'missing redirect URI' is appended.

Source

Thrown at nomad/structs/acl.go:2337

	// mechanism. This request doesn't write anything to Nomad's internal
	// state.
	WriteRequest
}

// Validate ensures the request object contains all the required fields in
// order to start the OIDC authentication flow.
func (a *ACLOIDCAuthURLRequest) Validate() error {

	var mErr multierror.Error

	if a.AuthMethodName == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing auth method name"))
	}
	if a.ClientNonce == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing client nonce"))
	}
	if a.RedirectURI == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing redirect URI"))
	}
	return mErr.ErrorOrNil()
}

// ACLOIDCAuthURLResponse is the response when starting the OIDC authentication
// login flow.
type ACLOIDCAuthURLResponse struct {

	// AuthURL is URL to begin authorization and is where the user logging in
	// should go.
	AuthURL string
}

// ACLOIDCCompleteAuthRequest is the request object to begin completing the
// OIDC auth cycle after receiving the callback from the OIDC provider.
type ACLOIDCCompleteAuthRequest struct {

	// AuthMethodName is the name of the auth method being used to login via

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set RedirectURI to the registered OIDC callback (e.g. http://localhost:8000/oidc/callback)
2. Ensure the CLI can start its local callback listener or pass the redirect URI explicitly
3. Match the RedirectURI exactly to one configured on the OIDC provider

Example fix

// before
req := &structs.ACLOIDCAuthURLRequest{AuthMethodName: "auth0", ClientNonce: nonce}
// after
req := &structs.ACLOIDCAuthURLRequest{AuthMethodName: "auth0", ClientNonce: nonce, RedirectURI: "http://localhost:8000/oidc/callback"}

if req.RedirectURI == "" { return errors.New("RedirectURI must match a callback registered on the OIDC provider") }

func hasRedirectURI(req *structs.ACLOIDCAuthURLRequest) bool { return req != nil && req.RedirectURI != "" }

if err := req.Validate(); err != nil {
  if strings.Contains(err.Error(), "missing redirect URI") { /* configure callback and retry */ }
}

When it happens

Trigger: Calling the OIDC auth-url endpoint with ACLOIDCAuthURLRequest.RedirectURI == "", e.g. 'nomad login' run without a callback listener/flag or a hand-built API request lacking RedirectURI.

Common situations: Running 'nomad login' in an environment where a local callback server cannot bind (hence no redirect URI); CI/automation calling the API directly without configuring the callback; mismatched callback config later rejected by the IdP.

Related errors

• missing OIDCDiscoveryURL
• missing OIDCClientID
• missing auth method name
• missing client nonce
• missing state

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/793651ac7fa84462. Report an issue: GitHub.