apache/pulsar · error · IOException

No athenz domain name specified

Error message

No athenz domain name specified

What it means

AuthenticationProviderAthenz.initialize() requires the set of allowed Athenz domain names. It reads them from the config property DOMAIN_NAME_LIST, falling back to the system property SYS_PROP_DOMAIN_NAME_LIST; if neither is set it throws this IOException, meaning the provider cannot be initialized because it would have no domains to accept tokens for.

Source

Thrown at pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java:74

    }

    @Override
    public void initialize(ServiceConfiguration config) throws IOException {
        initialize(Context.builder().config(config).build());
    }

    @Override
    public void initialize(Context context) throws IOException {
        authenticationMetrics = new AuthenticationMetrics(context.getOpenTelemetry(),
                getClass().getSimpleName(), getAuthMethodName());
        var config = context.getConfig();
        String domainNames;
        if (config.getProperty(DOMAIN_NAME_LIST) != null) {
            domainNames = (String) config.getProperty(DOMAIN_NAME_LIST);
        } else if (!StringUtils.isEmpty(System.getProperty(SYS_PROP_DOMAIN_NAME_LIST))) {
            domainNames = System.getProperty(SYS_PROP_DOMAIN_NAME_LIST);
        } else {
            throw new IOException("No athenz domain name specified");
        }

        domainNameList = Lists.newArrayList(domainNames.split(","));
        log.info().attr("domainNames", domainNameList).log("Supported domain names for Athenz");

        if (!StringUtils.isEmpty(System.getProperty(SYS_PROP_ALLOWED_OFFSET))) {
            try {
                allowedOffset = Integer.parseInt(System.getProperty(SYS_PROP_ALLOWED_OFFSET));
            } catch (NumberFormatException e) {
                throw new IOException("Invalid allowed offset for athenz role token verification specified", e);
            }

            if (allowedOffset < 0) {
                throw new IOException("Allowed offset for athenz role token verification must not be negative");
            }
        }

        log.info().attr("allowedOffsetSeconds", allowedOffset).log("Allowed offset for athenz role token verification");

View on GitHub (pinned to 820761864e)

Solutions

1. Set the Athenz domain list in the broker config, e.g. add the DOMAIN_NAME_LIST property to broker.conf (comma-separated domain names).
2. Alternatively set the JVM system property (e.g. -Dpulse.athenz.domain.names=dom1,dom2 per the provider's SYS_PROP constant) on the broker command line.
3. Verify the property key spelling matches the provider constants exactly.
4. Disable the athenz authentication provider if Athenz is not actually used.

Example fix

# before (broker.conf)
authenticationEnabled=true
authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderAthenz

# after
authenticationEnabled=true
authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderAthenz
athenzDomainNames=core.domain1,core.domain2

// before broker start
String domains = System.getProperty(ATHENZ_SYS_PROP_DOMAIN_NAME_LIST);
boolean configSet = brokerConfigProperties.getProperty("athenzDomainNames") != null;
if (domains == null || domains.isEmpty()) { /* fail fast with clear message */ }

try {
    provider.initialize(config);
} catch (IOException e) {
    if (e.getMessage().contains("No athenz domain name specified")) {
        log.error("Set athenzDomainNames in broker.conf or the system property");
    }
    throw e;
}

When it happens

Trigger: Broker starts with authProvider enabled (athenz) but neither configServiceProperty DOMAIN_NAME_LIST nor system property (athenz domain name list sysprop) is configured.

Common situations: Misconfigured broker.conf missing the athenz domain list property; operator set the property name with wrong casing/typo; deploying with authenticationEnabled=true but forgetting provider-specific settings.

Related errors

• Invalid broker configuration. Authentication must be enabled
• Invalid allowed offset for athenz role token verification sp
• Allowed offset for athenz role token verification must not b
• No secret key was provided for token authentication
• invalid algorithm provided ${tokenPublicAlg}

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/63342544f241bd8d. Report an issue: GitHub.