What causes "PublicKey algorithm cannot be null" in apache/pulsar?

Check the JWKS response of your OIDC issuer: ensure each key has an 'alg' (and 'kid') field; if missing, upgrade/reconfigure the identity provider to include alg in its JWKS

apache/pulsar · error · AuthenticationException

UNSUPPORTED_ALGORITHM

UNSUPPORTED_ALGORITHM

Error message

PublicKey algorithm cannot be null

What it means

verifyJWT needs to build a java-jwt Algorithm from the configured public key algorithm name, but publicKeyAlg is null, so no verifier can be constructed. It throws AuthenticationException(UNSUPPORTED_ALGORITHM) and records a failure metric before any signature verification happens.

Source

Thrown at pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/AuthenticationProviderOpenID.java:409

        }
    }

    /**
     * Build and return a validator for the parameters.
     *
     * @param publicKey - the public key to use when configuring the validator
     * @param publicKeyAlg - the algorithm for the parameterized public key
     * @param jwt - jwt to be verified and returned (only if verified)
     * @return a validator to use for validating a JWT associated with the parameterized public key.
     * @throws AuthenticationException if the Public Key's algorithm is not supported or if the algorithm param does not
     * match the Public Key's actual algorithm.
     */
    DecodedJWT verifyJWT(PublicKey publicKey,
                                String publicKeyAlg,
                                DecodedJWT jwt) throws AuthenticationException {
        if (publicKeyAlg == null) {
            incrementFailureMetric(AuthenticationExceptionCode.UNSUPPORTED_ALGORITHM);
            throw new AuthenticationException("PublicKey algorithm cannot be null");
        }

        Algorithm alg;
        try {
            switch (publicKeyAlg) {
                case ALG_RS256:
                    alg = Algorithm.RSA256((RSAPublicKey) publicKey, null);
                    break;
                case ALG_RS384:
                    alg = Algorithm.RSA384((RSAPublicKey) publicKey, null);
                    break;
                case ALG_RS512:
                    alg = Algorithm.RSA512((RSAPublicKey) publicKey, null);
                    break;
                case ALG_ES256:
                    alg = Algorithm.ECDSA256((ECPublicKey) publicKey, null);
                    break;
                case ALG_ES384:

View on GitHub (pinned to 820761864e)

Solutions

Check the JWKS response of your OIDC issuer: ensure each key has an 'alg' (and 'kid') field; if missing, upgrade/reconfigure the identity provider to include alg in its JWKS
Verify the broker's oidc configuration (discovery/issuer URL) points at a standards-compliant provider so keys are fetched with their algorithms
If keys come from a keystore, ensure the algorithm name is set alongside the key when loaded
Upgrade the broker to a version whose JWKS parsing defaults kty->alg (e.g., RSA->RS256) if your provider omits alg

Example fix

// before: JWKS entry without alg consumed as-is
{"kty":"RSA","n":"...","e":"AQAB","kid":"k1"}
// after: reconfigure IdP to publish alg
{"kty":"RSA","alg":"RS256","n":"...","e":"AQAB","kid":"k1"}

Defensive patterns

Strategy: validation

Validate before calling

// validate JWKS entries before use
JsonObject key = jwks.getJsonObject(i);
if (key.getString("alg") == null) {
    throw new IllegalStateException("JWKS key '" + key.getString("kid") + "' lacks alg field");
}

Try / catch

try {
    return verifyJWT(publicKey, publicKeyAlg, jwt);
} catch (AuthenticationException e) {
    if (e.getMessage().contains("algorithm cannot be null")) {
        log.error("Public key algorithm not resolved; check IdP JWKS/keystore config");
    }
    throw e;
}

Prevention

Use an identity provider whose JWKS publishes 'alg' for every key
Validate JWKS payloads during broker startup and fail fast on missing alg
Keep broker OIDC discovery configuration accurate and testable
Pin and test the IdP version; check release notes for JWKS format changes

When it happens

Trigger: authenticateToken() calls verifyJWT() with publicKeyAlg == null, which happens when the algorithm name in the fetched JWKS key entry is missing or when the code that resolved the key from the JWKS/keystore failed to map the 'alg' parameter.

Common situations: The OIDC provider's JWKS endpoint returns a key without an 'alg' field (only 'kty'); broker cache/keystore stores keys without algorithm metadata; a custom subclass or test constructs the provider without setting the public key algorithm property.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/e63f44d26d58081b. Report an issue: GitHub.