apache/pulsar · error · IllegalArgumentException

Failed to parse SASL authParams

Error message

Failed to parse SASL authParams

What it means

AuthenticationSasl.configure(String) parses the encoded authParams string as JSON via AuthenticationUtil.configureFromJsonString(); an IOException during parsing is rethrown as IllegalArgumentException with this message. The authParams string must be a valid JSON object of key/value pairs (e.g. {"jaasClientSection":"..."}).

Source

Thrown at pulsar-client-auth-sasl/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationSasl.java:311

        }

        @Override
        public AuthenticationDataProvider create(String brokerHost) throws Exception {
            return shim.getAuthData(brokerHost);
        }
    }

    @Override
    public void configure(String encodedAuthParamString) {
        if (isBlank(encodedAuthParamString)) {
            log.info().attr("defaultSectionName", JAAS_DEFAULT_CLIENT_SECTION_NAME)
                    .log("authParams for SASL is empty, will use default JAAS client section name");
        }

        try {
            setAuthParams(AuthenticationUtil.configureFromJsonString(encodedAuthParamString));
        } catch (IOException e) {
            throw new IllegalArgumentException("Failed to parse SASL authParams", e);
        }
    }

    @Override
    @Deprecated
    public void configure(Map<String, String> authParams) {
        try {
            setAuthParams(authParams);
        }  catch (IOException e) {
            throw new IllegalArgumentException("Failed to parse SASL authParams", e);
        }
    }

    // use passed in parameter to config ange get jaasCredentialsContainer.
    private void setAuthParams(Map<String, String> authParams) throws PulsarClientException {
        this.configuration = authParams;

        // read section from config files of kerberos

View on GitHub (pinned to 820761864e)

Solutions

1. Validate the authParams string is well-formed JSON (e.g. parse it with a JSON parser) before passing it to configure().
2. Use the JSON form: {"jaasClientSection":"PulsarClient"} rather than key=value syntax.
3. If config comes from a file/URL, load and inline the JSON content; do not pass the path.
4. Check shell/framework escaping — quotes in JSON often get stripped by properties files or command lines.

Example fix

// before
auth.configure("jaasClientSection=PulsarClient"); // IllegalArgumentException
// after
auth.configure("{\"jaasClientSection\":\"PulsarClient\"}");

// Java: validate JSON before calling configure(String)
import com.fasterxml.jackson.databind.ObjectMapper;
private static final ObjectMapper MAPPER = new ObjectMapper();
static void validateSaslAuthParams(String s) {
    try { MAPPER.readTree(s).fields(); }
    catch (Exception e) { throw new IllegalArgumentException("authParams is not valid JSON", e); }
}

try {
    auth.configure(encodedAuthParamString);
} catch (IllegalArgumentException e) {
    log.error("Bad SASL authParams JSON: {}", e.getMessage(), e.getCause());
    throw new ConfigException("Fix authParams to be a JSON object", e);
}

When it happens

Trigger: Passing a malformed JSON string as the authParamString — e.g. missing quotes, unescaped characters, or passing a properties-style string like 'jaasClientSection=foo' instead of JSON.

Common situations: Configuring authParams in client configuration files or URLs where the value got mangled (shell quoting, YAML/properties interpolation); copying Kerberos-style config syntax instead of the JSON format Pulsar expects; passing a file path rather than JSON content.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Malformed configuration file
• Invalid token string, missing attributes
• Invalid authentication token
• Failed to parse tlsFactoryConfig as a JSON object
• Malformed authentication parameters

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/1791c64ad9291fc7. Report an issue: GitHub.