apache/pulsar · error · IllegalArgumentException

Unsupported auth method: ${authMethod}

Error message

Unsupported auth method: ${authMethod}

What it means

AuthenticationOAuth2.configure(encodedAuthParamString) parses the params, reads the 'type' key, and dispatches on the 'authMethod' / 'tokenEndpointAuthMethod' parameter. Only client_secret_post and tls_client_auth are handled; any other authMethod value throws this IllegalArgumentException ('Unsupported auth method: <value>').

Source

Thrown at pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/AuthenticationOAuth2.java:182

    @Override
    public String getAuthMethodName() {
        return AUTH_METHOD_NAME;
    }

    @Override
    public void configure(String encodedAuthParamString) {
        Map<String, String> params = parseAuthParameters(encodedAuthParamString);
        String type = params.getOrDefault(CONFIG_PARAM_TYPE, TYPE_CLIENT_CREDENTIALS);
        if (TYPE_CLIENT_CREDENTIALS.equals(type)) {
            TokenEndpointAuthMethod authMethod = TokenEndpointAuthMethod.fromValue(
                    params.getOrDefault(CONFIG_PARAM_TOKEN_ENDPOINT_AUTH_METHOD,
                            TokenEndpointAuthMethod.CLIENT_SECRET_POST.value()));
            if (authMethod == TokenEndpointAuthMethod.CLIENT_SECRET_POST) {
                this.flow = ClientCredentialsFlow.fromParameters(params);
            } else if (authMethod == TokenEndpointAuthMethod.TLS_CLIENT_AUTH) {
                this.flow = TlsClientAuthFlow.fromParameters(params);
            } else {
                throw new IllegalArgumentException("Unsupported auth method: " + authMethod);
            }
        } else {
            throw new IllegalArgumentException("Unsupported authentication type: " + type);
        }
    }

    protected Map<String, String> parseAuthParameters(String encodedAuthParamString) {
        if (StringUtils.isBlank(encodedAuthParamString)) {
            throw new IllegalArgumentException("No authentication parameters were provided");
        }
        Map<String, String> params;
        try {
            params = AuthenticationUtil.configureFromJsonString(encodedAuthParamString);
        } catch (IOException e) {
            throw new IllegalArgumentException("Malformed authentication parameters", e);
        }

        String earlyRefreshPercentStr = params.get(CONFIG_PARAM_EARLY_TOKEN_REFRESH_PERCENT);

View on GitHub (pinned to 820761864e)

Solutions

1. Change the authMethod parameter to 'client_secret_post' or 'tls_client_auth'.
2. If you need client_secret_basic, build via AuthenticationFactoryOAuth2 (which supports it as a flow) instead of configure().
3. Check exact spelling and value of the authMethod key in the JSON params.

Example fix

// before
{"type":"oauth2","authMethod":"private_key_jwt", ...} // throws
// after
{"type":"oauth2","authMethod":"client_secret_post","issuerUrl":"...","clientId":"...","clientSecret":"..."}

String authMethod = params.optString("authMethod");
if (!"client_secret_post".equals(authMethod) && !"tls_client_auth".equals(authMethod)) {
    throw new IllegalStateException("AuthenticationOAuth2.configure supports only client_secret_post/tls_client_auth, got: " + authMethod);
}
auth.configure(paramsJson);

try {
    auth.configure(json);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Unsupported auth method")) {
        throw new ConfigurationException("Use client_secret_post or tls_client_auth in params, or build via AuthenticationFactoryOAuth2 for other methods", e);
    }
    throw e;
}

When it happens

Trigger: Calling configure() with a params JSON whose authMethod/tokenEndpointAuthMethod is 'client_secret_basic', 'private_key_jwt', or any value other than client_secret_post/tls_client_auth.

Common situations: Reusing an OAuth2 config written for a different library that uses different auth-method names; expecting client_secret_basic to be supported via configure() when it is only available via the factory builder flow; typos like 'client_secret_Post'.

Related errors

• Unsupported authentication type: ${type}
• No authentication parameters were provided
• Unsupported token endpoint auth method: ${value}
• certFilePath must not be null
• keyFilePath must not be null

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/f1f3df8a77ad6166. Report an issue: GitHub.