apache/pulsar · error · RestException

Error caching authentication data for %s %s:- %s

Error message

Error caching authentication data for %s %s:- %s

What it means

When worker authentication is enabled and the runtime factory provides a FunctionAuthProvider, registerSource tries to cache the client's authentication data for the source. If cacheAuthData throws, the worker returns 500 INTERNAL_SERVER_ERROR with 'Error caching authentication data for <ComponentType> <sourceName>:- <reason>'. This is a server-side failure while preparing per-function credentials for the runtime, not a problem with the source config itself.

Source

Thrown at pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/SourcesImpl.java:226

                        try {
                            Optional<FunctionAuthData> functionAuthData = functionAuthProvider
                                    .cacheAuthData(finalFunctionDetails,
                                            authParams.getClientAuthenticationDataSource());

                            functionAuthData.ifPresent(authData ->
                                    functionMetaDataObj.setFunctionAuthSpec()
                                            .setData(authData.getData()));
                        } catch (Exception e) {
                            log.error().attr("componentType", ComponentTypeUtils.toString(componentType))

                                    .attr("tenant", tenant).attr("namespace", namespace)

                                    .attr("componentName", sourceName).exception(e)

                                    .log("Error caching authentication data for / /");


                            throw new RestException(Response.Status.INTERNAL_SERVER_ERROR,
                                    String.format("Error caching authentication data for %s %s:- %s",
                                            ComponentTypeUtils.toString(componentType), sourceName, e.getMessage()));
                        }
                    }
                });
            }

            PackageLocationMetaData packageLocationMetaData;
            try {
                packageLocationMetaData = getFunctionPackageLocation(functionMetaDataObj,
                        sourcePkgUrl, fileDetail, componentPackageFile);
            } catch (Exception e) {
                log.error().attr("componentType", ComponentTypeUtils.toString(componentType)).attr("tenant", tenant)

                        .attr("namespace", namespace).attr("componentName", sourceName).exception(e)

                        .log("Failed process / / package");
                throw new RestException(Response.Status.INTERNAL_SERVER_ERROR, e.getMessage());

View on GitHub (pinned to 820761864e)

Solutions

  1. Check the worker log entry 'Error caching authentication data for / /' for the full underlying stack trace.
  2. Verify the client authentication plugin configured for the CLI/API call is valid and its data source can be serialized by the runtime auth provider.
  3. Review the FunctionAuthProvider implementation configured in the worker (getAuthProvider) for bugs or incompatible versions.
  4. If auth data caching is unnecessary for the deployment, either disable worker authentication or use a runtime factory without a function auth provider.

Example fix

// before: worker conf pointing at an incompatible/absent auth provider
functionAuthProviderClassName: com.example.BrokenFunctionAuthProvider

// after: use the shipped provider for the configured runtime
functionAuthProviderClassName: org.apache.pulsar.functions.auth.KubernetesFunctionAuthProvider
Defensive patterns

Strategy: try-catch

Validate before calling

// Before registering, confirm the client auth data source is usable
if (authParams != null && authParams.getClientAuthenticationDataSource() != null) {
    Objects.requireNonNull(authParams.getClientAuthenticationDataSource(), "auth data source must not be null");
}

Try / catch

try {
    admin.sources().createSource(cfg, pkgUrl, archive);
} catch (PulsarAdminException e) {
    if (e.getStatusCode() == 500 && e.getMessage() != null && e.getMessage().startsWith("Error caching authentication data")) {
        // inspect worker logs; fix client auth plugin or worker auth provider, then retry
    } else {
        throw e;
    }
}

Prevention

When it happens

Trigger: registerSource with worker authenticationEnabled=true and a runtime factory auth provider whose cacheAuthData(clientAuthenticationDataSource) throws — e.g. serialization failure of auth data, backend store unavailable, or a misconfigured auth provider.

Common situations: Client passing an authentication data source the provider cannot serialize; Kubernetes runtime factory auth plugin failing to write secrets; auth plugin version mismatch between worker config and expected interface; auth backend (e.g. a state store) down.

Understand the failure class

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/f70b5cbf33cd08b7. Report an issue: GitHub.