apache/pulsar · error · AuthenticationException

DOMAIN_MISMATCH

DOMAIN_MISMATCH

Error message

Athenz RoleToken Domain mismatch, Expected: %s, Found: %s

What it means

authenticate() parses the role token and checks that its Athenz domain is one of the domains configured in initialize() (domainNameList). If token.getDomain() is not in that list, errorCode DOMAIN_MISMATCH is set and this AuthenticationException is thrown with the expected list and the found domain — the token may be valid but issued for a domain this broker does not accept.

Source

Thrown at pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java:144

            }

            if (roleToken == null) {
                errorCode = ErrorCode.NO_TOKEN;
                throw new AuthenticationException("Athenz token is null, can't authenticate");
            }
            if (roleToken.isEmpty()) {
                errorCode = ErrorCode.NO_TOKEN;
                throw new AuthenticationException("Athenz RoleToken is empty, Server is Using Athenz Authentication");
            }
                log.debug().attr("roleToken", roleToken)
                        .attr("clientAddress", clientAddress)
                        .log("Athenz RoleToken received from Client");

            RoleToken token = new RoleToken(roleToken);

            if (!domainNameList.contains(token.getDomain())) {
                errorCode = ErrorCode.DOMAIN_MISMATCH;
                throw new AuthenticationException(
                        String.format("Athenz RoleToken Domain mismatch, Expected: %s, Found: %s",
                                domainNameList.toString(), token.getDomain()));
            }

            // Synchronize for non-thread safe static calls inside athenz library
            synchronized (this) {
                PublicKey ztsPublicKey = AuthZpeClient.getZtsPublicKey(token.getKeyId());

                if (ztsPublicKey == null) {
                    errorCode = ErrorCode.NO_PUBLIC_KEY;
                    throw new AuthenticationException("Unable to retrieve ZTS Public Key");
                }

                if (token.validate(ztsPublicKey, allowedOffset, false, null)) {
                    log.debug().attr("roleToken", roleToken)
                            .attr("clientAddress", clientAddress)
                            .log("Athenz Role Token Authenticated for Client");
                    authenticationMetrics.recordSuccess();

View on GitHub (pinned to 820761864e)

Solutions

Add the token's domain (exactly as reported in the error) to the broker's athenz domain list config and restart.
Have the client obtain a role token for a domain the broker supports.
Check case/format: domainNameList uses exact String contains(), so normalize case and remove stray spaces around commas in the configured list.

Example fix

// before
athenzDomainNames=core.domain1
// after
athenzDomainNames=core.domain1,core.domain2

Defensive patterns

Strategy: try-catch

Validate before calling

// client side, decode token domain before sending
RoleToken t = new RoleToken(roleToken);
// broker-side expected domains must include t.getDomain()

Try / catch

try {
    principal = provider.authenticate(authData);
} catch (AuthenticationException e) {
    if (e.getMessage().startsWith("Athenz RoleToken Domain mismatch")) {
        // parse Found: domain from message; either fix client domain or broker list
    }
    throw e;
}

Prevention

Keep the broker's athenzDomainNames list in sync with all client domains.
Compare domains case-consistently; avoid stray spaces in the comma list.
Verify token issuance domain in staging before production rollout.

When it happens

Trigger: Client presents a role token whose principal's domain differs from every entry in the broker's DOMAIN_NAME_LIST (case-sensitive contains() comparison).

Common situations: Domain list in broker.conf missing the newly onboarded Athenz domain; typo/case mismatch in domain names; client authenticated against the wrong Athenz tenant/domain; multi-tenant deployment sharing one broker config.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/05092d871ac70217. Report an issue: GitHub.