apache/pulsar · error · RestException

Error caching authentication data for %s %s:- %s

Error message

Error caching authentication data for %s %s:- %s

What it means

When worker authentication is enabled and the configured function auth provider supports caching client credentials, registerSink tries cacheAuthData(...) to store auth data for the sink's runtime. Any exception there becomes HTTP 500 'Error caching authentication data for Sink <name>:- <reason>'. This is a server-side storage/provider failure, not a problem with the sink code itself.

Source

Thrown at pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/SinksImpl.java:226

                        try {
                            Optional<FunctionAuthData> functionAuthData = functionAuthProvider
                                    .cacheAuthData(finalFunctionDetails,
                                            authParams.getClientAuthenticationDataSource());

                            functionAuthData.ifPresent(authData ->
                                    functionMetaDataObj.setFunctionAuthSpec()
                                            .setData(authData.getData()));
                        } catch (Exception e) {
                            log.error().attr("componentType", ComponentTypeUtils.toString(componentType))

                                    .attr("tenant", tenant).attr("namespace", namespace)

                                    .attr("componentName", sinkName).exception(e)

                                    .log("Error caching authentication data for / /");


                            throw new RestException(Response.Status.INTERNAL_SERVER_ERROR,
                                    String.format("Error caching authentication data for %s %s:- %s",
                                            ComponentTypeUtils.toString(componentType), sinkName, e.getMessage()));
                        }
                    }
                });
            }

            PackageLocationMetaData packageLocationMetaData;
            try {
                packageLocationMetaData = getFunctionPackageLocation(functionMetaDataObj,
                        sinkPkgUrl, fileDetail, componentPackageFile);
            } catch (Exception e) {
                log.error().attr("componentType", ComponentTypeUtils.toString(componentType)).attr("tenant", tenant)

                        .attr("namespace", namespace).attr("componentName", sinkName).exception(e)

                        .log("Failed process / / package");
                throw new RestException(Response.Status.INTERNAL_SERVER_ERROR, e.getMessage());

View on GitHub (pinned to 820761864e)

Solutions

1. Inspect the '- ' message and worker logs for the provider's root cause.
2. Verify the client supplied valid credentials (AuthenticationDataSource non-null and of a supported type).
3. Check the auth data backing store used by the runtime factory's provider is reachable and writable.
4. If function-runtime auth caching is not needed, disable/unset the functionAuthProvider in worker.conf or run with authentication consistent with cluster policy.

Example fix

// worker.conf before: provider set but backing store wrong
functionAuthProvider=org.apache.pulsar.functions.auth.KubernetesFunctionAuthProvider
// after: align with runtime or disable
functionRuntimeFactoryDependencies=...
# use matching config for k8s auth secret storage or omit functionAuthProvider when auth caching is unnecessary

if (authParams == null || authParams.getClientAuthenticationDataSource() == null) {
  // worker will skip caching; ensure your cluster policy allows that
}

try { admin.sinks().createSink(cfg, archive); } catch (PulsarAdminException e) { if (e.getStatusCode() == 500 && e.getMessage().contains("Error caching authentication data")) { /* inspect provider config / credentials, not the sink code */ } }

When it happens

Trigger: registerSink on a worker with authenticationEnabled=true and a functionAuthProvider configured, where the provider fails to serialize/store the client AuthenticationDataSource (e.g. backing store unavailable, unsupported credential type, serialization error).

Common situations: Misconfigured FunctionAuthProvider in worker.conf; auth data source type not supported by the provider; state store/BookKeeper used for function auth data unreachable; token-based credentials missing/expired on the client.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Error caching authentication data for %s %s:- %s
• Error caching authentication data for %s %s:- %s
• e
• Invalid combination of Original principal cannot be empty if
• Need to authenticate to perform the request

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/32ec48b841edaa6f. Report an issue: GitHub.