apache/pulsar · error · AuthenticationException

NO_CLIENT

NO_CLIENT

Error message

Authentication data source does not have a client address

What it means

authenticate() needs the client's peer address to validate Athenz role tokens (tokens are IP-bound). When the AuthenticationDataSource carries no peer data (hasDataFromPeer() false), the provider records errorCode NO_CLIENT and throws this AuthenticationException — it cannot verify the token against a client IP.

Source

Thrown at pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java:116

    }

    @Override
    public void incrementFailureMetric(Enum<?> errorCode) {
        authenticationMetrics.recordFailure(errorCode);
    }

    @Override
    public String authenticate(AuthenticationDataSource authData) throws AuthenticationException {
        SocketAddress clientAddress;
        String roleToken;
        ErrorCode errorCode = ErrorCode.UNKNOWN;
        try {

            if (authData.hasDataFromPeer()) {
                clientAddress = authData.getPeerAddress();
            } else {
                errorCode = ErrorCode.NO_CLIENT;
                throw new AuthenticationException("Authentication data source does not have a client address");
            }

            if (authData.hasDataFromCommand()) {
                roleToken = authData.getCommandData();
            } else if (authData.hasDataFromHttp()) {
                roleToken = authData.getHttpHeader(AuthZpeClient.ZPE_TOKEN_HDR);
            } else {
                errorCode = ErrorCode.NO_TOKEN;
                throw new AuthenticationException("Authentication data source does not have a role token");
            }

            if (roleToken == null) {
                errorCode = ErrorCode.NO_TOKEN;
                throw new AuthenticationException("Athenz token is null, can't authenticate");
            }
            if (roleToken.isEmpty()) {
                errorCode = ErrorCode.NO_TOKEN;
                throw new AuthenticationException("Athenz RoleToken is empty, Server is Using Athenz Authentication");

View on GitHub (pinned to 820761864e)

Solutions

1. Populate the peer address in the AuthenticationDataSource at the transport layer before calling authenticate().
2. If behind a proxy, forward the real client address (e.g. PROXY protocol / X-Forwarded-For) and ensure Pulsar is configured to trust it.
3. In tests, use an AuthenticationDataSource implementation that returns a peer address from hasDataFromPeer()/getPeerAddress().

Example fix

// before
AuthenticationData authData = new AuthenticationDataCommand(authToken);
provider.authenticate(authData);
// after
AuthenticationData authData = new AuthenticationDataSource() {
    public boolean hasDataFromPeer() { return true; }
    public String getPeerAddress() { return clientIp; }
    public boolean hasDataFromCommand() { return true; }
    public String getCommandData() { return authToken; }
};
provider.authenticate(authData);

// before calling authenticate
if (!authData.hasDataFromPeer() || authData.getPeerAddress() == null) {
    throw new IllegalArgumentException("AuthenticationDataSource must carry peer address for athenz");
}

try {
    principal = provider.authenticate(authData);
} catch (AuthenticationException e) {
    // NO_CLIENT: attach peer address at transport layer and retry
    throw new AuthenticationException("peer address missing: " + e.getMessage(), e);
}

When it happens

Trigger: Calling AuthenticationProviderAthenz.authenticate(authData) with a data source constructed without peer address (e.g. command-data-only source, test stub, or transport path that doesn't populate peer address).

Common situations: Custom protocol handler or proxy feeding authentication data without the remote address; unit tests passing new AuthenticationDataSource(){} with only command data; internal broker-to-broker calls lacking peer info.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Allowed offset for athenz role token verification must not b
• No athenz domain name specified
• Invalid allowed offset for athenz role token verification sp
• NO_TOKEN
• DOMAIN_MISMATCH

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/5da3caddb0ce4372. Report an issue: GitHub.