apache/pulsar · critical · IllegalArgumentException

Missing configured value for:

Error message

Missing configured value for: 

What it means

An IllegalArgumentException thrown by validateIssuers during initialize when the allowedTokenIssuers configuration property is null or empty (and empty issuers are not permitted). Initialization of the OpenID authentication provider fails immediately because without at least one issuer the plugin can authenticate no tokens.

Source

Thrown at pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/AuthenticationProviderOpenID.java:494

            throw new AuthenticationException("JWT verification failed: " + e.getMessage());
        }
    }

    /**
     * Validate the configured allow list of allowedIssuers. The allowedIssuers set must be nonempty in order for
     * the plugin to authenticate any token. Thus, it fails initialization if the configuration is
     * missing. Each issuer URL should use the HTTPS scheme. The plugin fails initialization if any
     * issuer url is insecure, unless requireHttps is false.
     * @param allowedIssuers - issuers to validate
     * @param requireHttps - whether to require https for issuers.
     * @param allowEmptyIssuers - whether to allow empty issuers. This setting only makes sense when kubernetes is used
     *                   as a fallback issuer.
     * @return the validated issuers
     * @throws IllegalArgumentException if the allowedIssuers is empty, or contains insecure issuers when required
     */
    private Set<String> validateIssuers(Set<String> allowedIssuers, boolean requireHttps, boolean allowEmptyIssuers) {
        if (allowedIssuers == null || (allowedIssuers.isEmpty() && !allowEmptyIssuers)) {
            throw new IllegalArgumentException("Missing configured value for: " + ALLOWED_TOKEN_ISSUERS);
        }
        for (String issuer : allowedIssuers) {
            if (!issuer.toLowerCase().startsWith("https://")) {
                log.warn().attr("issuer", issuer).log("Allowed issuer is not using https scheme");
                if (requireHttps) {
                    throw new IllegalArgumentException("Issuer URL does not use https, but must: " + issuer);
                }
            }
        }
        return allowedIssuers;
    }

    /**
     * Validate the configured allow list of allowedAudiences. The allowedAudiences must be set because
     * JWT must have an audience claim.
     * See https://openid.net/specs/openid-connect-basic-1_0.html#IDTokenValidation.
     * @param allowedAudiences
     * @return the validated audiences

View on GitHub (pinned to 820761864e)

Solutions

1. Set authenticationProviderOpenID.allowedTokenIssuers in broker.conf to a comma-separated list of HTTPS issuer URLs
2. Fix any templating/typo issues so the property is actually present and non-empty
3. If running against Kubernetes service-account tokens intentionally, enable the kubernetes fallback so empty issuers are permitted
4. Restart/reload the broker after correcting the configuration

Example fix

// before (broker.conf)
# authenticationProviderOpenID.allowedTokenIssuers= (missing)
// after
authenticationProviderOpenID.allowedTokenIssuers=https://accounts.google.com,https://login.microsoftonline.com/<tenant>/v2.0

// Before starting the broker, check the property resolves to a non-empty issuer set
Set<String> issuers = parseCsv(config.getString("authenticationProviderOpenID.allowedTokenIssuers"));
if (issuers == null || issuers.isEmpty()) {
    throw new IllegalStateException("authenticationProviderOpenID.allowedTokenIssuers must be set");
}

try {
    provider.initialize(config);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("allowedTokenIssuers")) {
        throw new IllegalStateException("OIDC provider requires a non-empty allowedTokenIssuers setting", e);
    }
    throw e;
}

When it happens

Trigger: Broker starts with the OpenID auth provider enabled but the authenticationProviderOpenID.allowedTokenIssuers property absent, set to an empty string, or resolving to an empty set; also raised when allowEmptyIssuers is false (kubernetes fallback not enabled) and the set is empty.

Common situations: Fresh broker.conf where OIDC properties were never added; a typo in the property name so the value is silently missing; configuration templating that rendered an empty value; operators disabling an IdP by clearing its issuer from the list entirely.

Related errors

• UNSUPPORTED_ALGORITHM
• ALGORITHM_MISMATCH
• Issuer URL does not use https, but must:
• UNSUPPORTED_ISSUER
• Neither METADATA_STORE_INSTANCE configuration set in the BK

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/ea14b5c8745cdf41. Report an issue: GitHub.