{"record":{"id":"05092d871ac70217","repo":"apache/pulsar","slug":"domain-mismatch","errorCode":"DOMAIN_MISMATCH","errorMessage":"Athenz RoleToken Domain mismatch, Expected: %s, Found: %s","messagePattern":"Athenz RoleToken Domain mismatch, Expected: (.+?), Found: (.+?)","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java","lineNumber":144,"sourceCode":"            }\n\n            if (roleToken == null) {\n                errorCode = ErrorCode.NO_TOKEN;\n                throw new AuthenticationException(\"Athenz token is null, can't authenticate\");\n            }\n            if (roleToken.isEmpty()) {\n                errorCode = ErrorCode.NO_TOKEN;\n                throw new AuthenticationException(\"Athenz RoleToken is empty, Server is Using Athenz Authentication\");\n            }\n                log.debug().attr(\"roleToken\", roleToken)\n                        .attr(\"clientAddress\", clientAddress)\n                        .log(\"Athenz RoleToken received from Client\");\n\n            RoleToken token = new RoleToken(roleToken);\n\n            if (!domainNameList.contains(token.getDomain())) {\n                errorCode = ErrorCode.DOMAIN_MISMATCH;\n                throw new AuthenticationException(\n                        String.format(\"Athenz RoleToken Domain mismatch, Expected: %s, Found: %s\",\n                                domainNameList.toString(), token.getDomain()));\n            }\n\n            // Synchronize for non-thread safe static calls inside athenz library\n            synchronized (this) {\n                PublicKey ztsPublicKey = AuthZpeClient.getZtsPublicKey(token.getKeyId());\n\n                if (ztsPublicKey == null) {\n                    errorCode = ErrorCode.NO_PUBLIC_KEY;\n                    throw new AuthenticationException(\"Unable to retrieve ZTS Public Key\");\n                }\n\n                if (token.validate(ztsPublicKey, allowedOffset, false, null)) {\n                    log.debug().attr(\"roleToken\", roleToken)\n                            .attr(\"clientAddress\", clientAddress)\n                            .log(\"Athenz Role Token Authenticated for Client\");\n                    authenticationMetrics.recordSuccess();","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java#L126-L162","documentation":"authenticate() parses the role token and checks that its Athenz domain is one of the domains configured in initialize() (domainNameList). If token.getDomain() is not in that list, errorCode DOMAIN_MISMATCH is set and this AuthenticationException is thrown with the expected list and the found domain — the token may be valid but issued for a domain this broker does not accept.","triggerScenarios":"Client presents a role token whose principal's domain differs from every entry in the broker's DOMAIN_NAME_LIST (case-sensitive contains() comparison).","commonSituations":"Domain list in broker.conf missing the newly onboarded Athenz domain; typo/case mismatch in domain names; client authenticated against the wrong Athenz tenant/domain; multi-tenant deployment sharing one broker config.","solutions":["Add the token's domain (exactly as reported in the error) to the broker's athenz domain list config and restart.","Have the client obtain a role token for a domain the broker supports.","Check case/format: domainNameList uses exact String contains(), so normalize case and remove stray spaces around commas in the configured list."],"exampleFix":"// before\nathenzDomainNames=core.domain1\n// after\nathenzDomainNames=core.domain1,core.domain2","handlingStrategy":"try-catch","validationCode":"// client side, decode token domain before sending\nRoleToken t = new RoleToken(roleToken);\n// broker-side expected domains must include t.getDomain()","typeGuard":null,"tryCatchPattern":"try {\n    principal = provider.authenticate(authData);\n} catch (AuthenticationException e) {\n    if (e.getMessage().startsWith(\"Athenz RoleToken Domain mismatch\")) {\n        // parse Found: domain from message; either fix client domain or broker list\n    }\n    throw e;\n}","preventionTips":["Keep the broker's athenzDomainNames list in sync with all client domains.","Compare domains case-consistently; avoid stray spaces in the comma list.","Verify token issuance domain in staging before production rollout."],"tags":["athenz","authentication","domain-mismatch","authorization"],"backgroundTag":"token-domain-mismatch","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}