apache/pulsar · critical · PulsarServerException

Failed to initialize authorization manager due to empty Conf

Error message

Failed to initialize authorization manager due to empty ConfigurationStoreServers

What it means

WebSocketService.start() enables the authorizationService when config.isAuthorizationEnabled() is true, but authorization needs cluster/config metadata resources built from ConfigurationStoreServers. If pulsarResources was never created (ConfigurationStoreServers empty/null) it throws PulsarServerException, aborting service startup.

Source

Thrown at pulsar-websocket/src/main/java/org/apache/pulsar/websocket/WebSocketService.java:115

    }

    public void start() throws PulsarServerException, PulsarClientException, MalformedURLException, ServletException {

        if (isNotBlank(config.getConfigurationMetadataStoreUrl())) {
            try {
                configMetadataStore = createConfigMetadataStore(config.getConfigurationMetadataStoreUrl(),
                        (int) config.getMetadataStoreSessionTimeoutMillis(),
                        config.isMetadataStoreAllowReadOnlyOperations());
            } catch (MetadataStoreException e) {
                throw new PulsarServerException(e);
            }
            pulsarResources = new PulsarResources(null, configMetadataStore);
        }

        // start authorizationService
        if (config.isAuthorizationEnabled()) {
            if (pulsarResources == null) {
                throw new PulsarServerException(
                        "Failed to initialize authorization manager due to empty ConfigurationStoreServers");
            }
            authorizationService = new AuthorizationService(this.config, pulsarResources);
        }
        // start authentication service
        authenticationService = new AuthenticationService(this.config);
        // initialize crypto key reader
        String cryptoFactoryClassName = (String) config.getProperties().get("cryptoKeyReaderFactoryClassName");
        if (StringUtils.isNotBlank(cryptoFactoryClassName)) {
            try {
                CryptoKeyReaderFactory factoryInstance = (CryptoKeyReaderFactory) Class.forName(cryptoFactoryClassName)
                        .getDeclaredConstructor().newInstance();
                cryptoKeyReader = Optional.ofNullable(factoryInstance.create());
            } catch (Exception e) {
                log.info().exception(e).log("Failed to initialize crypto-key reader");
                throw new PulsarServerException(e);
            }
        }

View on GitHub (pinned to 820761864e)

Solutions

1. Set configurationStoreServers in the websocket proxy configuration to the cluster's config metadata store URL
2. If the proxy does not need authorization, set authorizationEnabled=false
3. Verify the configuration actually loads the value (check the effective config, not just the file) and restart the service
4. Ensure the metadata store URL is reachable once set, or the next startup stage will fail

Example fix

// before
authorizationEnabled=true
# configurationStoreServers unset
// after
authorizationEnabled=true
configurationStoreServers=zk1:2181

if (conf.isAuthorizationEnabled() && (conf.getConfigurationStoreServers() == null || conf.getConfigurationStoreServers().isBlank())) { throw new IllegalStateException("configurationStoreServers must be set when authorizationEnabled=true"); }

boolean authConfigValid(WebSocketProxyConfiguration c) { return !c.isAuthorizationEnabled() || (c.getConfigurationStoreServers() != null && !c.getConfigurationStoreServers().isEmpty()); }

try { service.start(); } catch (PulsarServerException e) { if (e.getMessage().contains("ConfigurationStoreServers")) { failFast("Set configurationStoreServers or disable authorization"); } throw e; }

When it happens

Trigger: WebSocket proxy config has authorizationEnabled=true while configurationStoreServers is unset or empty, so the PulsarResources initialization branch (which requires a config metadata store URL) is skipped.

Common situations: Standalone websocket proxy deployed with auth enabled but no configuration store URL in websocket.conf; copying a broker config without the configurationStoreServers key; enabling authorization in dev without pointing the proxy at the cluster's metadata store.

Related errors

• Invalid broker configuration. Authentication must be enabled
• Invalid proxy configuration. Authentication must be enabled
• No offloader found for driver '${driverName}'. Please make s
• Could not open configuration file
• Malformed configuration file

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/0ef21c43800f7ea6. Report an issue: GitHub.