According to https://en.wikipedia.org/wiki/National_Command_Authority ,
Only the president can direct the use of nuclear weapons by U.S. armed forces, through plans like OPLAN 8010-12. The president has unilateral authority as commander-in-chief to order that nuclear weapons be used for any reason at any time.
While there does seem to be some disagreement, most experts claims' are similar to nuclear specialist Franklin Miller:
There’s no veto once the president has ordered a strike ... The president and only the president has the authority to order the use of nuclear weapons.
As @TedWrigley points out in the comments, there is always the possibility that someone along the chain of command refuses, but the system is specifically designed to avoid this, particularly once it gets beyond the high levels of command. There is the famous case of Harold Hering, who -- as @MartinSchröder points out -- was discharged for asking inconvenient questions. After that incident, the military reduced the ability for such people to unilaterally cancel a verified order. Also, even though the Secretary of Defense has to verify the order, they do not have legal veto power. They only exist to verify that the president did indeed order the attack.
Finally, it should be noted that a counterpoint to the general consensus is that military personal are required to disobey unlawful orders. However, by design, the system works extremely quickly. It is designed to go from presidential order to launch within minutes. The whole point of the president having such unilateral power is that if an attack by an enemy (read: soviets) occurs, you have about 2-5 minutes before the missiles hit. Additionally, keep in mind that the orders can be given to people like sub commanders that will have little ability to actually determine if the attack is 'lawful' or not. Again, the system is designed so that verified orders are carried out, not second guessed by low level military personal.
Or does the President have absolute discretion to initiate a nuclear attack?
Yes, the President has the sole authority to issue an attack, which would then be verified by the Sec Defense. If that person refused (or another high level official, such as the leaders in strategic command), it would be pure speculation as to what would happen.
Additional Sources of Interest: