apache/pulsar · error · RestException

Unauthorized to validateTopicPolicyOperation for operation [

Error message

Unauthorized to validateTopicPolicyOperation for operation [%s] on topic [%s] on policy [%s]

What it means

Authorization check failure in validateTopicPolicyOperationAsync: the authenticated role is not permitted to perform the requested policy operation on the topic; the authorization manager denied the check and the forbidden error is thrown.

Source

Thrown at pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java:1244

    }

    public void validateTopicPolicyOperation(TopicName topicName, PolicyName policy, PolicyOperation operation) {
        sync(()-> validateTopicPolicyOperationAsync(topicName, policy, operation));
    }

    public CompletableFuture<Void> validateTopicPolicyOperationAsync(TopicName topicName,
                                                                     PolicyName policy, PolicyOperation operation) {
        if (pulsar().getConfiguration().isAuthenticationEnabled()
                && pulsar().getBrokerService().isAuthorizationEnabled()) {
            if (!isClientAuthenticated(clientAppId())) {
                return FutureUtil.failedFuture(
                        new RestException(Status.FORBIDDEN, "Need to authenticate to perform the request"));
            }
            return pulsar().getBrokerService().getAuthorizationService()
                    .allowTopicPolicyOperationAsync(topicName, policy, operation, originalPrincipal(), clientAppId(),
                            clientAuthData()).thenAccept(isAuthorized -> {
                        if (!isAuthorized) {
                            throw new RestException(Status.FORBIDDEN,
                                    String.format("Unauthorized to validateTopicPolicyOperation"
                                            + " for operation [%s] on topic [%s] on policy [%s]", operation.toString(),
                                    topicName, policy.toString()));
                        }
                    });
        }
        return CompletableFuture.completedFuture(null);
    }

    public CompletableFuture<Void> validateTopicOperationAsync(TopicName topicName, TopicOperation operation) {
       return validateTopicOperationAsync(topicName, operation, null);
    }

    public CompletableFuture<Void> validateTopicOperationAsync(TopicName topicName,
                                                               TopicOperation operation, String subscription) {
        if (pulsar().getConfiguration().isAuthenticationEnabled()
                && pulsar().getBrokerService().isAuthorizationEnabled()) {
            if (!isClientAuthenticated(clientAppId())) {

View on GitHub (pinned to 820761864e)

Solutions

1. Grant the role the required policy permission via grant-permission
2. Verify the client is authenticating with the expected role

When it happens

Trigger: Thrown at pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java:1244 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/21712401c1ba2b69. Report an issue: GitHub.