apache/pulsar · error · IllegalArgumentException

Passed in parameter empty. KEYSTORE_PATH

Error message

Passed in parameter empty. KEYSTORE_PATH: ${keyStorePath} KEYSTORE_PW: ${keyStorePassword}

What it means

AuthenticationKeyStoreTls.configure(Map) throws IllegalArgumentException when keyStorePath or keyStorePassword is null/empty (checked with Guava Strings.isNullOrEmpty). Keystore-based TLS auth requires both the keystore file location and its password to load keys/trust material, so missing or blank values abort configuration. Note the message template prints the values, which may themselves contain sensitive password text.

Solutions

Set both 'keyStorePath' and 'keyStorePassword' in the authParams map passed to the plugin.
Verify environment/config templating actually expands the path and password values.
If the keystore has no password, provide an explicit non-empty password string as required by the keystore configuration.
Validate the params map at startup (assert both keys present and non-blank) before constructing the client.

Example fix

// before
params: {"keyStoreType": "JKS", "keyStorePath": "/certs/client.keystore.jks"} // keyStorePassword missing
// after
params: {"keyStoreType": "JKS", "keyStorePath": "/certs/client.keystore.jks", "keyStorePassword": "clientpw"}

Defensive patterns

Strategy: validation

Validate before calling

if (Strings.isNullOrEmpty(params.get("keyStorePath")) || Strings.isNullOrEmpty(params.get("keyStorePassword"))) {
    throw new IllegalArgumentException("keyStorePath and keyStorePassword are required for keystore TLS auth");
}

Try / catch

try {
    auth = new AuthenticationKeyStoreTls();
    auth.configure(params);
} catch (IllegalArgumentException e) {
    log.error("keystore TLS auth params invalid: {}", e.getMessage());
    throw e;
}

Prevention

Always include keyStorePath and keyStorePassword in the authParams map.
Validate config templating/expansion so placeholders resolve to real values.
If the keystore uses no password, still supply an explicit non-empty password value.
Smoke-test keystore loading (KeyStore.load) in startup checks before connecting.

When it happens

Trigger: Configuring auth with AuthenticationKeyStoreTls where authParams lacks 'keyStorePath' or 'keyStorePassword', or supplies them as empty strings; also hit when environment expansion in the params string resolves to empty.

Common situations: authParams JSON only setting keyStoreType; keystores with genuinely empty passwords (unsupported here); config templating leaving ${KEYSTORE_PATH} unexpanded so it resolves oddly; migrating from PEM TLS auth to keystore auth without porting all params.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/fd3f2c7768068d7e. Report an issue: GitHub.

Appendix: source

Thrown at pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationKeyStoreTls.java:123

        // in ":" "," format.
        params = (params == null || params.isEmpty())
                ? AuthenticationUtil.configureFromPulsar1AuthParamString(paramsString)
                : params;

        configure(params);
    }

    @SuppressWarnings("deprecation")
    @Override
    public void configure(Map<String, String> params) {
        String keyStoreType = params.get(KEYSTORE_TYPE);
        String keyStorePath = params.get(KEYSTORE_PATH);
        String keyStorePassword = params.get(KEYSTORE_PW);

        if (Strings.isNullOrEmpty(keyStorePath)
            || Strings.isNullOrEmpty(keyStorePassword)) {
            throw new IllegalArgumentException("Passed in parameter empty. "
                                               + KEYSTORE_PATH + ": " + keyStorePath
                                               + " " + KEYSTORE_PW + ": " + keyStorePassword);
        }

        if (Strings.isNullOrEmpty(keyStoreType)) {
            keyStoreType = DEFAULT_KEYSTORE_TYPE;
        }

        this.keyStoreParams = KeyStoreParams.builder()
                .keyStoreType(keyStoreType)
                .keyStorePath(keyStorePath)
                .keyStorePassword(keyStorePassword)
                .build();
    }

    @Override
    public void start() throws PulsarClientException {
        // noop

View on GitHub (pinned to 820761864e)