apache/pulsar · error · IllegalArgumentException

Failed to parse authParams

Error message

Failed to parse authParams

What it means

AuthenticationAthenz.configure(String) parses the authParams string as JSON via AuthenticationUtil.configureFromJsonString. If the string is blank-checked ok but is not valid JSON (IOException during parsing), it is rethrown as IllegalArgumentException with message 'Failed to parse authParams' and the IOException as cause.

Source

Thrown at pulsar-client-auth-athenz/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationAthenz.java:204

        @Override
        public String roleToken() {
            return shim.currentRoleToken();
        }

        @Override
        public String roleHeaderName() {
            return shim.currentRoleHeaderName();
        }
    }

    @Override
    public void configure(String encodedAuthParamString) {
        checkArgument(isNotBlank(encodedAuthParamString), "authParams must not be empty");

        try {
            setAuthParams(AuthenticationUtil.configureFromJsonString(encodedAuthParamString));
        } catch (IOException e) {
            throw new IllegalArgumentException("Failed to parse authParams", e);
        }
    }

    @Override
    @Deprecated
    public void configure(Map<String, String> authParams) {
        setAuthParams(authParams);
    }

    private void setAuthParams(Map<String, String> authParams) {
        this.tenantDomain = authParams.get("tenantDomain");
        this.tenantService = authParams.get("tenantService");
        this.providerDomain = authParams.get("providerDomain");
        this.keyId = authParams.getOrDefault("keyId", "0");
        this.autoPrefetchEnabled = Boolean.parseBoolean(authParams.getOrDefault("autoPrefetchEnabled", "false"));

        if (isNotBlank(authParams.get("x509CertChain"))) {
            // When using Copper Argos

View on GitHub (pinned to 820761864e)

Solutions

1. Wrap the params in valid JSON: '{"tenant":"...","service":"...","privateKey":"data:..."}'
2. Validate the JSON with a parser (e.g. jq or a quick ObjectMapper readTree) before passing it to configure()
3. Check the cause (IOException / Jackson message) in the stack trace for the exact parse offset

Example fix

// before
auth.configure("tenant=mytenant;service=svc");
// after
auth.configure("{\"tenant\":\"mytenant\",\"service\":\"svc\"}");

new ObjectMapper().readTree(authParamsString); // throws if not valid JSON — run before configure()
if (authParamsString == null || authParamsString.isBlank()) throw new IllegalArgumentException("authParams must not be empty");

boolean isJson(String s) {
    try { new ObjectMapper().readTree(s); return true; } catch (Exception e) { return false; }
}

try {
    authentication.configure(authParamsJson);
} catch (IllegalArgumentException e) {
    log.error("authParams is not valid JSON: {}", e.getCause() != null ? e.getCause().getMessage() : e.getMessage());
    throw new ConfigException("Fix the JSON in authParams for the Athenz auth plugin", e);
}

When it happens

Trigger: Calling authentication.configure(...) with a string that is non-blank but not valid JSON, e.g. properties-style 'tenant=mytenant' instead of '{"tenant":"mytenant",...}'.

Common situations: Pulsar client conf where authParams contains JSON with smart quotes, trailing commas, or unescaped characters; users pasting the properties-style param format expected by other auth plugins (e.g. basic/token auth).

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Failed to load private key from privateKey or privateKeyPath
• Invalid URL format
• Unsupported media type or encoding format:
• Invalid privateKey format
• Cannnot get absolute path from specified URL

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/f83280e78f3b5e58. Report an issue: GitHub.