{"record":{"id":"0aa9e7f7e5a47f24","repo":"apache/pulsar","slug":"allowed-offset-for-athenz-role-token-verification","errorCode":null,"errorMessage":"Allowed offset for athenz role token verification must not be negative","messagePattern":"Allowed offset for athenz role token verification must not be negative","errorType":"console","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java","lineNumber":88,"sourceCode":"            domainNames = (String) config.getProperty(DOMAIN_NAME_LIST);\n        } else if (!StringUtils.isEmpty(System.getProperty(SYS_PROP_DOMAIN_NAME_LIST))) {\n            domainNames = System.getProperty(SYS_PROP_DOMAIN_NAME_LIST);\n        } else {\n            throw new IOException(\"No athenz domain name specified\");\n        }\n\n        domainNameList = Lists.newArrayList(domainNames.split(\",\"));\n        log.info().attr(\"domainNames\", domainNameList).log(\"Supported domain names for Athenz\");\n\n        if (!StringUtils.isEmpty(System.getProperty(SYS_PROP_ALLOWED_OFFSET))) {\n            try {\n                allowedOffset = Integer.parseInt(System.getProperty(SYS_PROP_ALLOWED_OFFSET));\n            } catch (NumberFormatException e) {\n                throw new IOException(\"Invalid allowed offset for athenz role token verification specified\", e);\n            }\n\n            if (allowedOffset < 0) {\n                throw new IOException(\"Allowed offset for athenz role token verification must not be negative\");\n            }\n        }\n\n        log.info().attr(\"allowedOffsetSeconds\", allowedOffset).log(\"Allowed offset for athenz role token verification\");\n    }\n\n    @Override\n    public String getAuthMethodName() {\n        return \"athenz\";\n    }\n\n    @Override\n    public void incrementFailureMetric(Enum<?> errorCode) {\n        authenticationMetrics.recordFailure(errorCode);\n    }\n\n    @Override\n    public String authenticate(AuthenticationDataSource authData) throws AuthenticationException {","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java#L70-L106","documentation":"initialize() parses the allowed clock offset for role token verification and rejects negative values with this IOException. A negative offset would shift token validity windows in an unsupported way, so the provider refuses to start.","triggerScenarios":"System property SYS_PROP_ALLOWED_OFFSET is set to a negative integer such as -1 or -60.","commonSituations":"Operator intended to shrink tolerance and used a negative number; copy-pasted offset tuning advice meant for a different (signed) setting.","solutions":["Set the offset system property to a non-negative integer of seconds, e.g. 0 or 30.","Use 0 to enforce strict timestamp validation with no skew tolerance.","Remove the property to fall back to the library default."],"exampleFix":"// before\n-Dathenz.allowed.offset=-30\n// after\n-Dathenz.allowed.offset=30","handlingStrategy":"validation","validationCode":"String off = System.getProperty(ATHENZ_SYS_PROP_ALLOWED_OFFSET);\nif (off != null && !off.isEmpty() && Integer.parseInt(off.trim()) < 0) {\n    throw new IllegalArgumentException(\"allowed offset must be >= 0\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    provider.initialize(config);\n} catch (IOException e) {\n    if (e.getMessage().contains(\"must not be negative\")) {\n        log.error(\"Clamp the offset system property to a non-negative integer\");\n    }\n    throw e;\n}","preventionTips":["Use 0 for strict validation rather than negative offsets.","Clamp parsed values with Math.max(0, value) in config tooling.","Document valid ranges for the offset property in deployment templates."],"tags":["athenz","authentication","configuration","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}