apache/pulsar · error · IllegalArgumentException

Role token signer secret file doesn't exist

Error message

Role token signer secret file  doesn't exist

What it means

Sasl provider initialization failure in readSecretFromUrl: the configured secret-conf path (file: URL or plain path) does not exist on disk, so the role-token signer secret cannot be loaded; the path is the faulty input, typically a bad authenticationParameters config on the broker.

Source

Thrown at pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java:223

            .attr("token", token)
            .attr("role", token.getUserRole())
            .attr("session", token.getSession())
            .attr("expires", token.getExpires())
            .attr("signed", signed)
            .log("Created role token");
        return signed;
    }

    private byte[] readSecretFromUrl(String secretConfUrl) throws IOException {
        if (secretConfUrl.startsWith("file:")) {
            URI filePath = URI.create(secretConfUrl);
            return Files.readAllBytes(Paths.get(filePath));
        } else if (Files.exists(Paths.get(secretConfUrl))) {
            // Assume the key content was passed in a valid file path
            return Files.readAllBytes(Paths.get(secretConfUrl));
        } else {
            String msg = "Role token signer secret file " + secretConfUrl + " doesn't exist";
            throw new IllegalArgumentException(msg);
        }
    }

    // return authState if it is in cache.
    private AuthenticationState getAuthState(HttpServletRequest request) {
        String id = request.getHeader(SASL_STATE_SERVER);
        if (id == null) {
            return null;
        }

        try {
            return authStates.getIfPresent(Long.parseLong(id));
        } catch (NumberFormatException e) {
            log.error().attr("requestURI", request.getRequestURI())
                    .attr("id", id).exception(e)
                    .log("Wrong Id String in Token");
            return null;
        }

View on GitHub (pinned to 820761864e)

Solutions

1. Verify the secret file path exists and is readable by the broker
2. Use a proper file: URL if the path is not plain filesystem

When it happens

Trigger: Thrown at pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java:223 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/040fec6b5baebd92. Report an issue: GitHub.