apache/pulsar · error · IllegalArgumentException

No authentication parameters were provided

Error message

No authentication parameters were provided

What it means

AuthenticationOAuth2.parseAuthParameters() rejects a null, empty, or whitespace-only auth params string up front, throwing this IllegalArgumentException. The OAuth2 plugin cannot be configured without at least issuer/client credentials, so blank input is treated as a programming/config error rather than ignored.

Source

Thrown at pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/AuthenticationOAuth2.java:191

        if (TYPE_CLIENT_CREDENTIALS.equals(type)) {
            TokenEndpointAuthMethod authMethod = TokenEndpointAuthMethod.fromValue(
                    params.getOrDefault(CONFIG_PARAM_TOKEN_ENDPOINT_AUTH_METHOD,
                            TokenEndpointAuthMethod.CLIENT_SECRET_POST.value()));
            if (authMethod == TokenEndpointAuthMethod.CLIENT_SECRET_POST) {
                this.flow = ClientCredentialsFlow.fromParameters(params);
            } else if (authMethod == TokenEndpointAuthMethod.TLS_CLIENT_AUTH) {
                this.flow = TlsClientAuthFlow.fromParameters(params);
            } else {
                throw new IllegalArgumentException("Unsupported auth method: " + authMethod);
            }
        } else {
            throw new IllegalArgumentException("Unsupported authentication type: " + type);
        }
    }

    protected Map<String, String> parseAuthParameters(String encodedAuthParamString) {
        if (StringUtils.isBlank(encodedAuthParamString)) {
            throw new IllegalArgumentException("No authentication parameters were provided");
        }
        Map<String, String> params;
        try {
            params = AuthenticationUtil.configureFromJsonString(encodedAuthParamString);
        } catch (IOException e) {
            throw new IllegalArgumentException("Malformed authentication parameters", e);
        }

        String earlyRefreshPercentStr = params.get(CONFIG_PARAM_EARLY_TOKEN_REFRESH_PERCENT);
        if (earlyRefreshPercentStr != null) {
            double percent = parseEarlyRefreshPercent(earlyRefreshPercentStr);
            this.earlyTokenRefreshPercent = percent;
            if (percent < 1 && this.scheduler == null) {
                this.scheduler = INTERNAL_SCHEDULER;
            }
        }
        return params;
    }

View on GitHub (pinned to 820761864e)

Solutions

1. Provide a non-blank auth params JSON string, e.g. {"type":"oauth2","issuerUrl":"...","clientId":"...","clientSecret":"..."}.
2. Fix the env var/property feeding the params value.
3. Only call configure() when params are actually present; use the default constructor + factory otherwise.

Example fix

// before
String params = System.getenv("PULSAR_AUTH_PARAMS"); // null
auth.configure(params); // throws
// after
String params = System.getenv("PULSAR_AUTH_PARAMS");
if (params != null && !params.isBlank()) {
    auth.configure(params);
}

if (paramsJson == null || paramsJson.isBlank()) {
    throw new IllegalStateException("OAuth2 auth params must be provided (non-blank JSON)");
}
auth.configure(paramsJson);

try {
    auth.configure(paramsJson);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("No authentication parameters")) {
        log.error("Auth params string is blank; check PULSAR_AUTH_PARAMS/config source");
        throw new ConfigurationException("Missing OAuth2 auth parameters", e);
    }
    throw e;
}

When it happens

Trigger: Calling configure("") or configure(null); passing a config value read from an unset environment variable or empty property into configure().

Common situations: Auth params sourced from PULSAR_AUTH_PARAMS env var that was never set; a YAML/properties placeholder left unfilled; concatenating params where the OAuth2 section is empty.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unsupported auth method: ${authMethod}
• Unsupported authentication type: ${type}
• Unsupported token endpoint auth method: ${value}
• certFilePath must not be null
• keyFilePath must not be null

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/1cb75fe57be50e98. Report an issue: GitHub.