apache/pulsar · error · AuthenticationException

NO_TOKEN

NO_TOKEN

Error message

Authentication data source does not have a role token

What it means

authenticate() extracts the Athenz role token either from the command payload or from the ZPE HTTP header. If the AuthenticationDataSource has neither command data nor HTTP data, errorCode NO_TOKEN is set and this AuthenticationException is thrown: there is no credential at all to verify.

Source

Thrown at pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java:125

        SocketAddress clientAddress;
        String roleToken;
        ErrorCode errorCode = ErrorCode.UNKNOWN;
        try {

            if (authData.hasDataFromPeer()) {
                clientAddress = authData.getPeerAddress();
            } else {
                errorCode = ErrorCode.NO_CLIENT;
                throw new AuthenticationException("Authentication data source does not have a client address");
            }

            if (authData.hasDataFromCommand()) {
                roleToken = authData.getCommandData();
            } else if (authData.hasDataFromHttp()) {
                roleToken = authData.getHttpHeader(AuthZpeClient.ZPE_TOKEN_HDR);
            } else {
                errorCode = ErrorCode.NO_TOKEN;
                throw new AuthenticationException("Authentication data source does not have a role token");
            }

            if (roleToken == null) {
                errorCode = ErrorCode.NO_TOKEN;
                throw new AuthenticationException("Athenz token is null, can't authenticate");
            }
            if (roleToken.isEmpty()) {
                errorCode = ErrorCode.NO_TOKEN;
                throw new AuthenticationException("Athenz RoleToken is empty, Server is Using Athenz Authentication");
            }
                log.debug().attr("roleToken", roleToken)
                        .attr("clientAddress", clientAddress)
                        .log("Athenz RoleToken received from Client");

            RoleToken token = new RoleToken(roleToken);

            if (!domainNameList.contains(token.getDomain())) {
                errorCode = ErrorCode.DOMAIN_MISMATCH;

View on GitHub (pinned to 820761864e)

Solutions

1. Configure the client's authentication plugin/parameters to supply the Athenz role token.
2. If HTTP, ensure the ZPE token header (per AuthZpeClient.ZPE_TOKEN_HDR) is present and not stripped by proxies/LBs.
3. Verify the broker's authenticationProviders list matches the client's auth method.

Example fix

// before
client --auth-plugin skip --broker requiring athenz
// after
bin/pulsar-client --url pulsar://host:6650 \
  --auth-plugin org.apache.pulsar.client.impl.auth.AuthenticationAthenz \
  --auth-params '{"roleToken":"..."}'

// client side, before connecting
boolean hasCred = authParams != null && (authParams.containsKey("roleToken") || !authToken.isEmpty());
if (!hasCred) throw new IllegalArgumentException("Athenz role token required");

try {
    principal = provider.authenticate(authData);
} catch (AuthenticationException e) {
    // NO_TOKEN: client sent no credential — reject with auth challenge
    throw new AuthenticationException("no role token supplied", e);
}

When it happens

Trigger: Client connects without sending the Athenz token in the auth data (Authenticate command data empty) or HTTP request lacks the ZPE token header.

Common situations: Client not configured with Athenz credentials while broker requires athenz provider; proxy stripping the ZPE_TOKEN_HDR header; using a client library that doesn't forward the token on initial connect.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No athenz domain name specified
• Invalid allowed offset for athenz role token verification sp
• Allowed offset for athenz role token verification must not b
• NO_CLIENT
• DOMAIN_MISMATCH

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/71485851f8384c2c. Report an issue: GitHub.