apache/pulsar · error · AuthenticationException

INVALID_TOKEN

INVALID_TOKEN

Error message

Unknown user or invalid password

What it means

HTTP Basic auth rejection in AuthenticationProviderBasic.authenticate: the supplied user id is absent from the configured user map or its password does not match the stored hash (apr1-md5, bcrypt, or crypt variants); the user credential pair is the faulty input.

Source

Thrown at pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderBasic.java:146

        String userId = authParams.getUserId();
        String password = authParams.getPassword();
        String msg = "Unknown user or invalid password";
        ErrorCode errorCode = ErrorCode.UNKNOWN;
        try {
            if (users.get(userId) == null) {
                errorCode = ErrorCode.INVALID_AUTH_DATA;
                throw new AuthenticationException(msg);
            }

            String encryptedPassword = users.get(userId);

            // For md5 algorithm
            if ((users.get(userId).startsWith("$apr1"))) {
                List<String> splitEncryptedPassword = Arrays.asList(encryptedPassword.split("\\$"));
                if (splitEncryptedPassword.size() != 4 || !encryptedPassword
                        .equals(Md5Crypt.apr1Crypt(password.getBytes(), splitEncryptedPassword.get(2)))) {
                    errorCode = ErrorCode.INVALID_TOKEN;
                    throw new AuthenticationException(msg);
                }
                // For crypt algorithm
            } else if (!encryptedPassword.equals(Crypt.crypt(password.getBytes(), encryptedPassword.substring(0, 2)))) {
                errorCode = ErrorCode.INVALID_TOKEN;
                throw new AuthenticationException(msg);
            }
        } catch (AuthenticationException exception) {
            incrementFailureMetric(errorCode);
            throw exception;
        }
        authenticationMetrics.recordSuccess();
        return userId;
    }

    private class AuthParams {
        private String userId;
        private String password;

View on GitHub (pinned to 820761864e)

Solutions

1. Correct the password in the client credentials
2. Regenerate the stored password hash if the encoding scheme ($apr1/bcrypt) mismatched

When it happens

Trigger: Thrown at pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderBasic.java:146 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/c20f88c5657b2cd7. Report an issue: GitHub.