apache/pulsar · error · IllegalArgumentException

Malformed authentication parameters

Error message

Malformed authentication parameters

What it means

After the blank check, parseAuthParameters() parses the params string as JSON via AuthenticationUtil.configureFromJsonString. If parsing throws IOException (invalid JSON), the exception is rethrown as IllegalArgumentException with message 'Malformed authentication parameters' and the IOException as cause.

Source

Thrown at pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/AuthenticationOAuth2.java:197

            } else if (authMethod == TokenEndpointAuthMethod.TLS_CLIENT_AUTH) {
                this.flow = TlsClientAuthFlow.fromParameters(params);
            } else {
                throw new IllegalArgumentException("Unsupported auth method: " + authMethod);
            }
        } else {
            throw new IllegalArgumentException("Unsupported authentication type: " + type);
        }
    }

    protected Map<String, String> parseAuthParameters(String encodedAuthParamString) {
        if (StringUtils.isBlank(encodedAuthParamString)) {
            throw new IllegalArgumentException("No authentication parameters were provided");
        }
        Map<String, String> params;
        try {
            params = AuthenticationUtil.configureFromJsonString(encodedAuthParamString);
        } catch (IOException e) {
            throw new IllegalArgumentException("Malformed authentication parameters", e);
        }

        String earlyRefreshPercentStr = params.get(CONFIG_PARAM_EARLY_TOKEN_REFRESH_PERCENT);
        if (earlyRefreshPercentStr != null) {
            double percent = parseEarlyRefreshPercent(earlyRefreshPercentStr);
            this.earlyTokenRefreshPercent = percent;
            if (percent < 1 && this.scheduler == null) {
                this.scheduler = INTERNAL_SCHEDULER;
            }
        }
        return params;
    }

    /**
     * Parses the {@code earlyRefreshPercent} configuration value.
     *
     * <p>If the string contains a decimal point it is interpreted as a fractional value in [0, 1]
     * and used directly (e.g. {@code "0.8"} → 0.8). Otherwise the string is treated as an integer

View on GitHub (pinned to 820761864e)

Solutions

1. Fix the JSON syntax: double-quoted keys and string values, valid commas, no trailing commas.
2. Validate the string with a JSON parser (e.g. Jackson) before calling configure().
3. If your params are in key=value form, convert them to JSON first.

Example fix

// before
auth.configure("issuerUrl=https://auth.example.com clientId=my-client"); // not JSON -> throws
// after
auth.configure("{"issuerUrl":"https://auth.example.com","clientId":"my-client","clientSecret":"s3cret"}");

try {
    new ObjectMapper().readTree(paramsJson); // syntax check only
} catch (JsonProcessingException e) {
    throw new IllegalStateException("Auth params are not valid JSON: " + e.getOriginalMessage(), e);
}
auth.configure(paramsJson);

try {
    auth.configure(paramsJson);
} catch (IllegalArgumentException e) {
    if (e.getMessage().equals("Malformed authentication parameters")) {
        log.error("Auth params must be valid JSON; cause: {}", e.getCause());
        throw new ConfigurationException("Fix JSON syntax in auth params", e);
    }
    throw e;
}

When it happens

Trigger: Calling configure() with a string that is not valid JSON — e.g. key=value style 'issuerUrl=https://... clientId=...', single quotes instead of double quotes, trailing commas, or truncated JSON.

Common situations: Hand-editing the authParams string in client.conf and breaking JSON syntax; using shell env values with unescaped quotes; pasting params from docs that use a non-JSON format.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• earlyTokenRefreshPercent must be greater than 0.
• Required configuration parameters: tlsCertFile, tlsKeyFile
• Unsupported auth method: ${tokenEndpointAuthMethod}
• EarlyTokenRefreshPercent must be greater than 0.
• Unsupported auth method: ${authMethod}

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/3dc4c13f61ee7a7c. Report an issue: GitHub.