apache/pulsar · error · IllegalArgumentException

saslJaasServerRoleTokenSignerSecretPath parameter is empty

Error message

saslJaasServerRoleTokenSignerSecretPath parameter is empty

What it means

AuthenticationProviderSasl.initialize found the saslJaasServerRoleTokenSignerSecretPath configuration empty; without a secret file the server cannot sign/verify role tokens, so SASL provider initialization fails.

Source

Thrown at pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java:123

        if (jaasCredentialsContainer == null) {
            log.info().attr("value", loginContextName).log("JAAS loginContext is:.");
            try {
                jaasCredentialsContainer = new JAASCredentialsContainer(
                    loginContextName,
                    new PulsarSaslServer.SaslServerCallbackHandler(allowedIdsPattern),
                    configuration);
            } catch (LoginException e) {
                log.error().exception(e).log("JAAS login in broker failed");
                throw new IOException(e);
            }
        }
        String saslJaasServerRoleTokenSignerSecretPath = config.getSaslJaasServerRoleTokenSignerSecretPath();
        byte[] secret = null;
        if (StringUtils.isNotBlank(saslJaasServerRoleTokenSignerSecretPath)) {
            secret = readSecretFromUrl(saslJaasServerRoleTokenSignerSecretPath);
        } else {
            String msg = "saslJaasServerRoleTokenSignerSecretPath parameter is empty";
            throw new IllegalArgumentException(msg);
        }
        this.signer = new SaslRoleTokenSigner(secret);
        this.authStates = Caffeine.newBuilder()
                .recordStats()
                .maximumSize(config.getMaxInflightSaslContext())
                .expireAfterWrite(config.getInflightSaslContextExpiryMs(), TimeUnit.MILLISECONDS).build();
        CacheMetricsCollector.CAFFEINE.addCache("auth-sasl-states-cache", authStates);
    }

    @Override
    public String getAuthMethodName() {
        return SaslConstants.AUTH_METHOD_NAME;
    }

    @Override
    public void close() throws IOException {
        if (jaasCredentialsContainer != null) {
            jaasCredentialsContainer.close();

View on GitHub (pinned to 820761864e)

Solutions

1. Set saslJaasServerRoleTokenSignerSecretPath in broker.conf to a valid secret file path

When it happens

Trigger: Thrown at pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java:123 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/ecf2f0ce3724b38f. Report an issue: GitHub.