apache/pulsar · error · IllegalArgumentException

Passed in parameter empty. KEYSTORE_PATH: ${keyStorePath} KE

Error message

Passed in parameter empty. KEYSTORE_PATH: ${keyStorePath} KEYSTORE_PW: ${keyStorePassword}

What it means

AuthenticationKeyStoreTls.configure(Map) throws IllegalArgumentException when keyStorePath or keyStorePassword is null/empty (checked with Guava Strings.isNullOrEmpty). Keystore-based TLS auth requires both the keystore file location and its password to load keys/trust material, so missing or blank values abort configuration. Note the message template prints the values, which may themselves contain sensitive password text.

Source

Thrown at pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationKeyStoreTls.java:123

        // in ":" "," format.
        params = (params == null || params.isEmpty())
                ? AuthenticationUtil.configureFromPulsar1AuthParamString(paramsString)
                : params;

        configure(params);
    }

    @SuppressWarnings("deprecation")
    @Override
    public void configure(Map<String, String> params) {
        String keyStoreType = params.get(KEYSTORE_TYPE);
        String keyStorePath = params.get(KEYSTORE_PATH);
        String keyStorePassword = params.get(KEYSTORE_PW);

        if (Strings.isNullOrEmpty(keyStorePath)
            || Strings.isNullOrEmpty(keyStorePassword)) {
            throw new IllegalArgumentException("Passed in parameter empty. "
                                               + KEYSTORE_PATH + ": " + keyStorePath
                                               + " " + KEYSTORE_PW + ": " + keyStorePassword);
        }

        if (Strings.isNullOrEmpty(keyStoreType)) {
            keyStoreType = DEFAULT_KEYSTORE_TYPE;
        }

        this.keyStoreParams = KeyStoreParams.builder()
                .keyStoreType(keyStoreType)
                .keyStorePath(keyStorePath)
                .keyStorePassword(keyStorePassword)
                .build();
    }

    @Override
    public void start() throws PulsarClientException {
        // noop

View on GitHub (pinned to 820761864e)

Solutions

Set both 'keyStorePath' and 'keyStorePassword' in the authParams map passed to the plugin.
Verify environment/config templating actually expands the path and password values.
If the keystore has no password, provide an explicit non-empty password string as required by the keystore configuration.
Validate the params map at startup (assert both keys present and non-blank) before constructing the client.

Example fix

// before
params: {"keyStoreType": "JKS", "keyStorePath": "/certs/client.keystore.jks"} // keyStorePassword missing
// after
params: {"keyStoreType": "JKS", "keyStorePath": "/certs/client.keystore.jks", "keyStorePassword": "clientpw"}

Defensive patterns

Strategy: validation

Validate before calling

if (Strings.isNullOrEmpty(params.get("keyStorePath")) || Strings.isNullOrEmpty(params.get("keyStorePassword"))) {
    throw new IllegalArgumentException("keyStorePath and keyStorePassword are required for keystore TLS auth");
}

Try / catch

try {
    auth = new AuthenticationKeyStoreTls();
    auth.configure(params);
} catch (IllegalArgumentException e) {
    log.error("keystore TLS auth params invalid: {}", e.getMessage());
    throw e;
}

Prevention

Always include keyStorePath and keyStorePassword in the authParams map.
Validate config templating/expansion so placeholders resolve to real values.
If the keystore uses no password, still supply an explicit non-empty password value.
Smoke-test keystore loading (KeyStore.load) in startup checks before connecting.

When it happens

Trigger: Configuring auth with AuthenticationKeyStoreTls where authParams lacks 'keyStorePath' or 'keyStorePassword', or supplies them as empty strings; also hit when environment expansion in the params string resolves to empty.

Common situations: authParams JSON only setting keyStoreType; keystores with genuinely empty passwords (unsupported here); config templating leaving ${KEYSTORE_PATH} unexpanded so it resolves oddly; migrating from PEM TLS auth to keystore auth without porting all params.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/fd3f2c7768068d7e. Report an issue: GitHub.