apache/pulsar · error · RestException

Error caching authentication data for %s %s:- %s

Error message

Error caching authentication data for %s %s:- %s

What it means

Raised by FunctionsImpl.registerFunction inside the asynchronous auth-data caching step. After admission succeeds, the worker tries to cache authentication data (e.g. secrets/credentials for the function); if that callback throws, the client receives an HTTP 500 (INTERNAL_SERVER_ERROR) RestException. The function may have been admitted but its auth data could not be cached, leaving registration incomplete.

Source

Thrown at pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/FunctionsImpl.java:226

                        try {
                            Optional<FunctionAuthData> functionAuthData = functionAuthProvider
                                    .cacheAuthData(finalFunctionDetails,
                                            authParams.getClientAuthenticationDataSource());

                            functionAuthData.ifPresent(authData ->
                                    functionMetaDataObj.setFunctionAuthSpec()
                                            .setData(authData.getData()));
                        } catch (Exception e) {
                            log.error().attr("componentType", ComponentTypeUtils.toString(componentType))

                                    .attr("tenant", tenant).attr("namespace", namespace)

                                    .attr("componentName", functionName).exception(e)

                                    .log("Error caching authentication data for / /");


                            throw new RestException(Response.Status.INTERNAL_SERVER_ERROR,
                                    String.format("Error caching authentication data for %s %s:- %s",
                                            ComponentTypeUtils.toString(componentType), functionName, e.getMessage()));
                        }
                    }
                });
            }

            PackageLocationMetaData packageLocationMetaData;
            try {
                packageLocationMetaData = getFunctionPackageLocation(functionMetaDataObj,
                        functionPkgUrl, fileDetail, componentPackageFile);
            } catch (Exception e) {
                log.error().attr("componentType", ComponentTypeUtils.toString(componentType)).attr("tenant", tenant)

                        .attr("namespace", namespace).attr("componentName", functionName).exception(e)

                        .log("Failed process /{/ package");
                throw new RestException(Response.Status.INTERNAL_SERVER_ERROR, e.getMessage());

View on GitHub (pinned to 820761864e)

Solutions

1. Check worker logs for 'Error caching authentication data' with the full stack trace to find the underlying cause.
2. Verify the worker's authenticationProvider and secret provider configuration in functions_worker.yml is correct and reachable.
3. If it was a transient metadata-store failure, retry the registration.
4. If auth data is not needed, resubmit without update-auth-data / without auth secrets configured.
5. Ensure the metadata store (ZooKeeper) is healthy and the worker has write access to the function auth-data path.

Example fix

// before
// worker with misconfigured provider
authenticationEnabled=true
authenticationProvider=my.company.BrokenAuthProvider
// after
# functions_worker.yml
authenticationEnabled=true
authenticationProvider=org.apache.pulsar.broker.authentication.AuthenticationProviderToken
tokenAuthProvider=...valid configuration...

try {
    admin.functions().createFunction(cfg, uploadConfig);
} catch (PulsarAdminException e) {
    if (e.getStatusCode() == 500 && e.getMessage().startsWith("Error caching authentication data")) {
        // metadata-store/auth provider issue; check worker health and retry once
        retryAfterHealthCheck(e);
    } else { throw e; }
}

When it happens

Trigger: registerFunction (or registerFunction with updateOptions.isUpdateAuthData() equivalents) when the auth cache write throws — e.g. misconfigured AuthenticationProvider, failure serializing auth params, or underlying ZooKeeper/metadata-store error while persisting the cached auth data for the component.

Common situations: Worker configured with an auth provider the function config doesn't match; metadata-store connectivity blips during registration; secrets injection misconfiguration (invalid secret provider configs) surfacing as a cache failure; upgrades where the auth data format changed.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Error caching authentication data for %s %s:- %s
• Error caching authentication data for %s %s:- %s
• Invalid combination of Original principal cannot be empty if
• Need to authenticate to perform the request
• <validation message from IllegalArgumentException>

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/a03116bfa926ba5a. Report an issue: GitHub.