apache/pulsar · critical · IllegalArgumentException

invalid algorithm provided ${tokenPublicAlg}

Error message

invalid algorithm provided ${tokenPublicAlg}

What it means

getPublicKeyAlgType reads tokenPublicAlg from the configuration and converts it to a jjwt SignatureAlgorithm. If SignatureAlgorithm.forName doesn't recognize the value it throws a SignatureException, which is rethrown as an IllegalArgumentException naming the invalid algorithm. Only used for the asymmetric (tokenPublicKey) path.

Source

Thrown at pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java:319

        }
    }

    private String getTokenRoleClaim(ServiceConfiguration conf) throws IOException {
        String tokenAuthClaim = (String) conf.getProperty(confTokenAuthClaimSettingName);
        if (StringUtils.isNotBlank(tokenAuthClaim)) {
            return tokenAuthClaim;
        } else {
            return Claims.SUBJECT;
        }
    }

    private SignatureAlgorithm getPublicKeyAlgType(ServiceConfiguration conf) throws IllegalArgumentException {
        String tokenPublicAlg = (String) conf.getProperty(confTokenPublicAlgSettingName);
        if (StringUtils.isNotBlank(tokenPublicAlg)) {
            try {
                return SignatureAlgorithm.forName(tokenPublicAlg);
            } catch (SignatureException ex) {
                throw new IllegalArgumentException("invalid algorithm provided " + tokenPublicAlg, ex);
            }
        } else {
            return SignatureAlgorithm.RS256;
        }
    }

    // get Token Audience Claim from configuration, if not configured return null.
    private String getTokenAudienceClaim(ServiceConfiguration conf) throws IllegalArgumentException {
        String tokenAudienceClaim = (String) conf.getProperty(confTokenAudienceClaimSettingName);
        if (StringUtils.isNotBlank(tokenAudienceClaim)) {
            return tokenAudienceClaim;
        } else {
            return null;
        }
    }

    // get Token Audience that stands for this broker from configuration, if not configured return null.
    private String getTokenAudience(ServiceConfiguration conf) throws IllegalArgumentException {

View on GitHub (pinned to 820761864e)

Solutions

1. Set tokenPublicAlg to a valid jjwt SignatureAlgorithm name: RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.
2. Remove tokenPublicAlg entirely to accept the RS256 default.
3. Check for stray whitespace/quotes around the value in the conf file.
4. Match the algorithm to the one actually used when the key pair was generated and tokens were signed (e.g. bin/pulsar tokens create-key-pair --output-algorithm ES256).

Example fix

// before (broker.conf)
tokenPublicAlg=rs512
// after
tokenPublicAlg=RS512

// Validate the configured algorithm against jjwt's registry before startup:
try {
    io.jsonwebtoken.SignatureAlgorithm.forName(conf.getProperty("tokenPublicAlg").toString().trim());
} catch (io.jsonwebtoken.SignatureException e) {
    throw new IllegalStateException("tokenPublicAlg must be one of RS256,RS384,RS512,ES256,ES384,ES512,PS256,PS384,PS512", e);
}

try {
    authenticationProvider.initialize(conf);
} catch (IllegalArgumentException e) {
    if (e.getMessage() != null && e.getMessage().startsWith("invalid algorithm provided")) {
        throw new IllegalStateException("Fix tokenPublicAlg in broker.conf; use an exact jjwt SignatureAlgorithm name", e);
    }
    throw e;
}

When it happens

Trigger: initialize configures the provider with a tokenPublicAlg value that is not a valid jjwt SignatureAlgorithm name (e.g. 'RS512 ' with whitespace, 'ES512-K', 'rs256' if the jjwt version requires exact case, or a completely unknown name).

Common situations: Typo in the algorithm name in broker.conf; using an algorithm name from another library's naming scheme; setting tokenPublicAlg while using a symmetric tokenSecretKey where it doesn't apply; whitespace or quoting artifacts around the value.

Related errors

• Invalid broker configuration. Authentication must be enabled
• No athenz domain name specified
• No secret key was provided for token authentication
• Invalid proxy configuration. Authentication must be enabled
• No offloader found for driver '${driverName}'. Please make s

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/fcff2dead72dba2b. Report an issue: GitHub.