apache/pulsar · error · RestException

Failed to get auth data from the request

Error message

Failed to get auth data from the request

What it means

After (optional) authentication, clientAppId checks whether the resolved clientId role is blank; if it is and authentication is enabled, it returns HTTP 401 'Failed to get auth data from the request'. Unlike error 1957 this is not an AuthenticationException — authentication either didn't produce a role or the provider returned an empty identity.

Source

Thrown at pulsar-websocket/src/main/java/org/apache/pulsar/websocket/admin/WebSocketWebResource.java:91

                if (authMethodName != null
                    && service().getAuthenticationService().getAuthenticationProvider(authMethodName) != null) {
                    authenticationDataSource = service().getAuthenticationService()
                            .getAuthenticationProvider(authMethodName)
                            .newHttpAuthState(httpRequest).getAuthDataSource();
                    clientId = service().getAuthenticationService().authenticateHttpRequest(
                            httpRequest, authenticationDataSource);
                } else {
                    clientId = service().getAuthenticationService().authenticateHttpRequest(httpRequest);
                    authenticationDataSource = new AuthenticationDataHttps(httpRequest);
                }
            } catch (AuthenticationException e) {
                if (service().getConfig().isAuthenticationEnabled()) {
                    throw new RestException(Status.UNAUTHORIZED, "Failed to get clientId from request");
                }
            }

            if (isBlank(clientId) && service().getConfig().isAuthenticationEnabled()) {
                throw new RestException(Status.UNAUTHORIZED, "Failed to get auth data from the request");
            }
        }
        return clientId;
    }

    public AuthenticationDataSource authData() throws AuthenticationException {
        return authenticationDataSource;
    }

    /**
     * Checks whether the user has Pulsar Super-User access to the system.
     *
     * @throws RestException
     *             if not authorized
     */
    protected void validateSuperUserAccess() {
        if (service().getConfig().isAuthenticationEnabled()) {
            String appId = clientAppId();

View on GitHub (pinned to 820761864e)

Solutions

1. Send a valid, non-empty credential header and confirm no intermediary strips it
2. Check the configured authentication provider actually extracts the role (test with the provider directly)
3. Verify authenticationProviders configuration matches the scheme your client sends
4. Enable auth debug logging on the proxy to see the parsed clientId before the blank check

Example fix

// before
Authorization: 
// after
Authorization: Bearer eyJhbGciOi...

if (authHeader == null || authHeader.isBlank()) { throw new IllegalStateException("Authorization header empty: proxy will reject with 'Failed to get auth data'"); }

boolean roleResolvable(String clientId) { return clientId != null && !clientId.isBlank(); }

try { String role = clientAppId(); if (role == null || role.isBlank()) { throw new UnauthorizedException("no role resolved"); } } catch (WebApplicationException e) { if (e.getResponse().getStatus() == 401) { reauthenticate(); } throw e; }

When it happens

Trigger: Request authenticated without producing a role string (empty header value, provider returning blank id), or the auth provider silently returns null clientId, while authenticationEnabled=true.

Common situations: Empty Authorization header that doesn't throw; custom authentication provider returning empty string; request routed through a gateway that strips the auth header.

Related errors

• Failed to get clientId from request
• Invalid broker configuration. Authentication must be enabled
• Label name cannot be null or empty
• domain() invoked from wrong resource
• Unauthorized to validateBothSuperuserAndClusterOperation for

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/bd62d584e5f1acb7. Report an issue: GitHub.