apache/pulsar · error · AuthenticationException

ISSUER_MISMATCH

ISSUER_MISMATCH

Error message

Issuer URL mismatch: [%s] should match [%s]

What it means

OpenID Connect metadata validation: the issuer returned in the discovered provider metadata is not identical to the issuer URL used to fetch it, violating the OIDC Discovery spec, so the metadata is rejected as potentially malicious/misconfigured.

Source

Thrown at pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/OpenIDProviderMetadataCache.java:235

     * Per the OpenID Connect Discovery spec, the issuer value returned MUST be identical to the
     * Issuer URL that was directly used to retrieve the configuration information. This MUST also
     * be identical to the iss Claim value in ID Tokens issued from this Issuer.
     * https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
     *
     * @param issuer - the issuer used to retrieve the metadata
     * @param metadata - the OpenID Provider Metadata
     * @param isK8s - whether the issuer is represented by the Kubernetes API server. This affects error reporting.
     * @throws AuthenticationException if the issuer does not exactly match the metadata issuer
     */
    private void verifyIssuer(@NonNull String issuer, OpenIDProviderMetadata metadata,
                              boolean isK8s) throws AuthenticationException {
        if (!issuer.equals(metadata.getIssuer())) {
            if (isK8s) {
                authenticationProvider.incrementFailureMetric(AuthenticationExceptionCode.UNSUPPORTED_ISSUER);
                throw new AuthenticationException("Issuer not allowed: " + issuer);
            } else {
                authenticationProvider.incrementFailureMetric(AuthenticationExceptionCode.ISSUER_MISMATCH);
                throw new AuthenticationException(String.format("Issuer URL mismatch: [%s] should match [%s]",
                        issuer, metadata.getIssuer()));
            }
        }
    }
}

View on GitHub (pinned to 820761864e)

Solutions

1. Correct the broker's issuer URL to exactly match the provider's advertised issuer
2. Fix the OIDC provider configuration so its metadata issuer matches the discovery endpoint

When it happens

Trigger: Thrown at pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/OpenIDProviderMetadataCache.java:235 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/51885934f360de3f. Report an issue: GitHub.