What causes "unknown auth provider: %s" in apache/pulsar?

Use the supported token plugin or the none plugin for the function's Go instance.

unknown auth provider: %s

Error message

unknown auth provider: %s

What it means

setupClient only recognizes authPluginToken and authPluginNone. Any other AuthenticationPlugin value reaches the default branch and returns this error naming the unknown provider, preventing client creation.

Source

Thrown at pulsar-function-go/pf/instance.go:231

		TLSValidateHostname:        ic.tlsHostnameVerification,
	}

	switch ic.authPlugin {
	case authPluginToken:
		switch {
		case strings.HasPrefix(ic.authParams, "file://"):
			clientOpts.Authentication = pulsar.NewAuthenticationTokenFromFile(ic.authParams[7:])
		case strings.HasPrefix(ic.authParams, "token:"):
			clientOpts.Authentication = pulsar.NewAuthenticationToken(ic.authParams[6:])
		case ic.authParams == "":
			return fmt.Errorf("auth plugin %s given, but authParams is empty", authPluginToken)
		default:
			return fmt.Errorf(`unknown token format - expecting "file://" or "token:" prefix`)
		}
	case authPluginNone:
		clientOpts.Authentication, _ = pulsar.NewAuthentication("", "") // ret: auth.NewAuthDisabled()
	default:
		return fmt.Errorf("unknown auth provider: %s", ic.authPlugin)
	}

	client, err := pulsar.NewClient(clientOpts)
	if err != nil {
		log.Errorf("create client error:%v", err)
		gi.stats.incrTotalSysExceptions(err)
		return err
	}
	gi.client = client
	return nil
}

func (gi *goInstance) setupProducer() error {
	if gi.context.instanceConf.funcDetails.Sink.Topic != "" && len(gi.context.instanceConf.funcDetails.Sink.Topic) > 0 {
		log.Debugf("Setting up producer for topic %s", gi.context.instanceConf.funcDetails.Sink.Topic)
		producer, err := gi.getProducer(gi.context.instanceConf.funcDetails.Sink.Topic)
		if err != nil {
			log.Errorf("Failed to create producer: %v", err)

View on GitHub (pinned to 820761864e)

Solutions

Use the supported token plugin or the none plugin for the function's Go instance.
Implement OAuth2 separately if needed, or file/track upstream support for the plugin.
Correct any typo in the plugin name in the function config.

Example fix

// before
--auth_plugin org.apache.pulsar.client.impl.auth.AuthenticationToken // unknown provider
// after
--auth_plugin auth.AuthenticationToken

Defensive patterns

Strategy: validation

Validate before calling

allowed := map[string]bool{"token": true, "none": true, "": true}
if !allowed[authPlugin] {
    return fmt.Errorf("unsupported auth plugin for Go functions: %s", authPlugin)
}

Try / catch

if err := runInstance(); err != nil && strings.HasPrefix(err.Error(), "unknown auth provider") {
    log.Fatalf("use the token or none auth plugin for Go functions, got: %v", err)
}

Prevention

Only use auth plugins supported by pulsar-function-go (token, none).
Don't copy Java/Python function auth plugin identifiers into Go function configs.
Keep an allowlist of plugin names in deployment tooling.

When it happens

Trigger: Setting AuthenticationPlugin to a plugin name not supported by pulsar-function-go (e.g. an OAuth2 or SASL plugin identifier accepted by the Java client but not here, or a typo like "tokon").

Common situations: Porting function configs from Java/Python function workers; typos in the plugin name; assuming parity of auth plugins across Pulsar clients.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/34dff0ff83dc9c77. Report an issue: GitHub.