{"record":{"id":"118a245a84b3e74d","repo":"apache/pulsar","slug":"unsupported-authentication-method-authmethodna","errorCode":null,"errorMessage":"Unsupported authentication method: [${authMethodName}].","messagePattern":"Unsupported authentication method: \\[(.+?)\\]\\.","errorType":"http","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationService.java","lineNumber":117,"sourceCode":"                if (providers.isEmpty()) {\n                    log.warn(\"No authentication providers are loaded.\");\n                }\n            } catch (Throwable e) {\n                throw new PulsarServerException(\"Failed to load an authentication provider.\", e);\n            }\n        } else {\n            log.info(\"Authentication is disabled\");\n        }\n    }\n\n    private String getAuthMethodName(HttpServletRequest request) {\n        return request.getHeader(AuthenticationFilter.PULSAR_AUTH_METHOD_NAME);\n    }\n\n    private AuthenticationProvider getAuthProvider(String authMethodName) throws AuthenticationException {\n        AuthenticationProvider providerToUse = providers.get(authMethodName);\n        if (providerToUse == null) {\n            throw new AuthenticationException(\n                    String.format(\"Unsupported authentication method: [%s].\", authMethodName));\n        }\n        return providerToUse;\n    }\n\n    @SuppressWarnings(\"deprecation\")\n    public boolean authenticateHttpRequest(HttpServletRequest request, HttpServletResponse response)\n            throws Exception {\n        String authMethodName = getAuthMethodName(request);\n        if (authMethodName == null\n                && SaslConstants.SASL_TYPE_VALUE.equalsIgnoreCase(request.getHeader(SaslConstants.SASL_HEADER_TYPE))) {\n            // This edge case must be handled because the Pulsar SASL implementation does not add the\n            // X-Pulsar-Auth-Method-Name header.\n            authMethodName = SaslConstants.AUTH_METHOD_NAME;\n        }\n        if (authMethodName != null) {\n            AuthenticationProvider providerToUse = getAuthProvider(authMethodName);\n            try {","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationService.java#L99-L135","documentation":"AuthenticationService looks up the AuthenticationProvider registered under the auth method name sent by the client in the 'Pulsar-Auth-Method-Name' HTTP header. If no provider with that name was configured on the broker (providers map has no such key), getAuthProvider throws AuthenticationException. This means the client is advertising an authentication method the broker does not support or has not loaded.","triggerScenarios":"An HTTP request carries header AuthenticationFilter.PULSAR_AUTH_METHOD_NAME with a value that has no matching entry in the providers map loaded from authenticationProviders config; e.g. client sends 'token' while broker only configured 'anonymous' or a differently named custom provider.","commonSituations":"Broker missing the provider class in authenticationProviders config; typo or case mismatch between client auth method name and provider.getAuthMethodName(); client upgraded to a new auth plugin the broker does not have; proxy strips/rewrites the auth method header; custom provider's getAuthMethodName() returns a value different from what clients send.","solutions":["Add the matching provider class (e.g. org.apache.pulsar.broker.authentication.AuthenticationProviderToken) to broker.conf authenticationProviders and restart","Make the client send the same auth method name the provider returns from getAuthMethodName() (check header value vs provider name, including case)","If using a custom provider, verify its getAuthMethodName() value and that the jar is on the broker's classpath","If auth should be optional, check whether the client should omit the header instead (with strictAuthMethod=false) or enable an anonymousUserRole"],"exampleFix":"// before (broker.conf)\nauthenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderTls\n// client sends Authorization: Bearer <jwt> with Pulsar-Auth-Method-Name: token -> Unsupported authentication method: [token]\n// after\nauthenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderTls,org.apache.pulsar.broker.authentication.AuthenticationProviderToken","handlingStrategy":"validation","validationCode":"String authMethodName = request.getHeader(\"Pulsar-Auth-Method-Name\");\nAuthenticationProvider p = authService.getAuthenticationProvider(authMethodName);\nif (p == null) {\n    throw new IllegalStateException(\"Broker has no provider for auth method: \" + authMethodName);\n}","typeGuard":null,"tryCatchPattern":"try {\n    authenticated = authService.authenticateHttpRequest(request, response);\n} catch (javax.naming.AuthenticationException e) {\n    if (e.getMessage().startsWith(\"Unsupported authentication method\")) {\n        // check broker authenticationProviders vs client auth method name\n    }\n    response.sendError(401, e.getMessage());\n}","preventionTips":["Keep client auth method name and broker provider getAuthMethodName() in sync","List every deployed provider class in authenticationProviders and verify startup logs show 'has been loaded'","Test the auth header value with a smoke request after broker config changes","Ship custom provider jars on the broker classpath before enabling them for clients"],"tags":["authentication","pulsar","configuration","http"],"backgroundTag":"unsupported-auth-method","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}