apache/pulsar · error · IllegalArgumentException

Failed to parse authParams

Error message

Failed to parse authParams

What it means

AuthenticationAthenz.configure(String) parses the authParams string as JSON via AuthenticationUtil.configureFromJsonString. If the string is blank-checked ok but is not valid JSON (IOException during parsing), it is rethrown as IllegalArgumentException with message 'Failed to parse authParams' and the IOException as cause.

Solutions

1. Wrap the params in valid JSON: '{"tenant":"...","service":"...","privateKey":"data:..."}'
2. Validate the JSON with a parser (e.g. jq or a quick ObjectMapper readTree) before passing it to configure()
3. Check the cause (IOException / Jackson message) in the stack trace for the exact parse offset

Example fix

// before
auth.configure("tenant=mytenant;service=svc");
// after
auth.configure("{\"tenant\":\"mytenant\",\"service\":\"svc\"}");

new ObjectMapper().readTree(authParamsString); // throws if not valid JSON — run before configure()
if (authParamsString == null || authParamsString.isBlank()) throw new IllegalArgumentException("authParams must not be empty");

boolean isJson(String s) {
    try { new ObjectMapper().readTree(s); return true; } catch (Exception e) { return false; }
}

try {
    authentication.configure(authParamsJson);
} catch (IllegalArgumentException e) {
    log.error("authParams is not valid JSON: {}", e.getCause() != null ? e.getCause().getMessage() : e.getMessage());
    throw new ConfigException("Fix the JSON in authParams for the Athenz auth plugin", e);
}

When it happens

Trigger: Calling authentication.configure(...) with a string that is non-blank but not valid JSON, e.g. properties-style 'tenant=mytenant' instead of '{"tenant":"mytenant",...}'.

Common situations: Pulsar client conf where authParams contains JSON with smart quotes, trailing commas, or unescaped characters; users pasting the properties-style param format expected by other auth plugins (e.g. basic/token auth).

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Failed to load private key from privateKey or…
• Invalid privateKey format
• Invalid URL format
• Unsupported media type or encoding format:
• Cannnot get absolute path from specified URL

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/f83280e78f3b5e58. Report an issue: GitHub.

Appendix: source

Thrown at pulsar-client-auth-athenz/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationAthenz.java:204

        @Override
        public String roleToken() {
            return shim.currentRoleToken();
        }

        @Override
        public String roleHeaderName() {
            return shim.currentRoleHeaderName();
        }
    }

    @Override
    public void configure(String encodedAuthParamString) {
        checkArgument(isNotBlank(encodedAuthParamString), "authParams must not be empty");

        try {
            setAuthParams(AuthenticationUtil.configureFromJsonString(encodedAuthParamString));
        } catch (IOException e) {
            throw new IllegalArgumentException("Failed to parse authParams", e);
        }
    }

    @Override
    @Deprecated
    public void configure(Map<String, String> authParams) {
        setAuthParams(authParams);
    }

    private void setAuthParams(Map<String, String> authParams) {
        this.tenantDomain = authParams.get("tenantDomain");
        this.tenantService = authParams.get("tenantService");
        this.providerDomain = authParams.get("providerDomain");
        this.keyId = authParams.getOrDefault("keyId", "0");
        this.autoPrefetchEnabled = Boolean.parseBoolean(authParams.getOrDefault("autoPrefetchEnabled", "false"));

        if (isNotBlank(authParams.get("x509CertChain"))) {
            // When using Copper Argos

View on GitHub (pinned to 820761864e)