{"record":{"id":"040fec6b5baebd92","repo":"apache/pulsar","slug":"role-token-signer-secret-file-doesn-t-exist","errorCode":null,"errorMessage":"Role token signer secret file  doesn't exist","messagePattern":"Role token signer secret file  doesn't exist","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java","lineNumber":223,"sourceCode":"            .attr(\"token\", token)\n            .attr(\"role\", token.getUserRole())\n            .attr(\"session\", token.getSession())\n            .attr(\"expires\", token.getExpires())\n            .attr(\"signed\", signed)\n            .log(\"Created role token\");\n        return signed;\n    }\n\n    private byte[] readSecretFromUrl(String secretConfUrl) throws IOException {\n        if (secretConfUrl.startsWith(\"file:\")) {\n            URI filePath = URI.create(secretConfUrl);\n            return Files.readAllBytes(Paths.get(filePath));\n        } else if (Files.exists(Paths.get(secretConfUrl))) {\n            // Assume the key content was passed in a valid file path\n            return Files.readAllBytes(Paths.get(secretConfUrl));\n        } else {\n            String msg = \"Role token signer secret file \" + secretConfUrl + \" doesn't exist\";\n            throw new IllegalArgumentException(msg);\n        }\n    }\n\n    // return authState if it is in cache.\n    private AuthenticationState getAuthState(HttpServletRequest request) {\n        String id = request.getHeader(SASL_STATE_SERVER);\n        if (id == null) {\n            return null;\n        }\n\n        try {\n            return authStates.getIfPresent(Long.parseLong(id));\n        } catch (NumberFormatException e) {\n            log.error().attr(\"requestURI\", request.getRequestURI())\n                    .attr(\"id\", id).exception(e)\n                    .log(\"Wrong Id String in Token\");\n            return null;\n        }","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java#L205-L241","documentation":"Sasl provider initialization failure in readSecretFromUrl: the configured secret-conf path (file: URL or plain path) does not exist on disk, so the role-token signer secret cannot be loaded; the path is the faulty input, typically a bad authenticationParameters config on the broker.","triggerScenarios":"Thrown at pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java:223 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the secret file path exists and is readable by the broker","Use a proper file: URL if the path is not plain filesystem"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}