GoogleContainerTools/jib · error · RegistryAuthenticationFailedException

'realm' was not found in the 'WWW-Authenticate' header, trie

Error message

'realm' was not found in the 'WWW-Authenticate' header, tried to parse: ${authenticationMethod}

What it means

After confirming the WWW-Authenticate header is a Bearer challenge, Jib extracts the 'realm' parameter to find the token service URL. If the header lacks realm="...", the challenge is malformed and Jib throws a RegistryAuthenticationFailedException including the raw header value.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java:92

      throws RegistryAuthenticationFailedException {
    // If the authentication method starts with 'basic' (case insensitive), no registry
    // authentication is needed.
    if (authenticationMethod.matches("^(?i)(basic).*")) {
      return Optional.empty();
    }

    String registryUrl = registryEndpointRequestProperties.getServerUrl();
    String imageName = registryEndpointRequestProperties.getImageName();
    // Checks that the authentication method starts with 'bearer ' (case insensitive).
    if (!authenticationMethod.matches("^(?i)(bearer) .*")) {
      throw newRegistryAuthenticationFailedException(
          registryUrl, imageName, authenticationMethod, "Bearer");
    }

    Pattern realmPattern = Pattern.compile("realm=\"(.*?)\"");
    Matcher realmMatcher = realmPattern.matcher(authenticationMethod);
    if (!realmMatcher.find()) {
      throw newRegistryAuthenticationFailedException(
          registryUrl, imageName, authenticationMethod, "realm");
    }
    String realm = realmMatcher.group(1);

    Pattern servicePattern = Pattern.compile("service=\"(.*?)\"");
    Matcher serviceMatcher = servicePattern.matcher(authenticationMethod);
    // use the provided registry location when missing service (e.g., for OpenShift)
    String service = serviceMatcher.find() ? serviceMatcher.group(1) : registryUrl;

    return Optional.of(
        new RegistryAuthenticator(
            realm, service, registryEndpointRequestProperties, userAgent, httpClient));
  }

  private static RegistryAuthenticationFailedException newRegistryAuthenticationFailedException(
      String registry, String repository, String authenticationMethod, String authParam) {
    return new RegistryAuthenticationFailedException(
        registry,

View on GitHub (pinned to fb949e2676)

Solutions

Fix the registry/token service so the Bearer challenge includes realm="https://.../token"
Upgrade or replace the private registry's authentication middleware
Test with curl -v to inspect the WWW-Authenticate header returned by the registry
Point Jib at a spec-compliant registry implementation (Distribution registry:2, cloud registries)

Example fix

// before (registry challenge)
WWW-Authenticate: Bearer service="myregistry.local"
// after
WWW-Authenticate: Bearer realm="https://myregistry.local/service/token",service="myregistry.local"

Defensive patterns

Strategy: validation

Validate before calling

HttpURLConnection c = (HttpURLConnection) new URL("https://registry/v2/").openConnection();
String wwwAuth = c.getHeaderField("WWW-Authenticate");
if (wwwAuth != null && !wwwAuth.contains("realm=\"")) {
  throw new IllegalStateException("Bearer challenge missing realm: " + wwwAuth);
}

Try / catch

try {
  jibBuild.containerize(...);
} catch (RegistryAuthenticationException e) {
  if (e.getMessage().contains("'realm' was not found")) {
    throw new IllegalStateException("Registry token service is misconfigured (no realm)", e);
  }
}

Prevention

Configure REGISTRY_AUTH_TOKEN_REALM correctly on registry:2 deployments
Verify the challenge with curl -v after any auth middleware change
Use well-tested token implementations (docker_auth, keycloak gatekeeper)

When it happens

Trigger: A registry returns a Bearer WWW-Authenticate header without a realm parameter, e.g. 'Bearer service="registry"' with no realm="...".

Common situations: Buggy or partially configured token-auth implementations on private registries; custom auth proxies emitting incomplete challenges; registry software generating non-standard headers.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/7e46487fe4228b2f. Report an issue: GitHub.