{"record":{"id":"1347704ebce2d3a5","repo":"apache/pulsar","slug":"getprivatekey-called-on-a-producer-side-cryptokeyr","errorCode":null,"errorMessage":"getPrivateKey called on a producer-side CryptoKeyReaderAdapter","messagePattern":"getPrivateKey called on a producer-side CryptoKeyReaderAdapter","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"pulsar-client-v5/src/main/java/org/apache/pulsar/client/impl/v5/CryptoKeyReaderAdapter.java","lineNumber":77,"sourceCode":"     */\n    static CryptoKeyReader forConsumer(PrivateKeyProvider provider) {\n        return new CryptoKeyReaderAdapter(null, provider);\n    }\n\n    @Override\n    public EncryptionKeyInfo getPublicKey(String keyName, Map<String, String> metadata) {\n        if (publicKeyProvider == null) {\n            throw new UnsupportedOperationException(\n                    \"getPublicKey called on a consumer-side CryptoKeyReaderAdapter\");\n        }\n        var v5Key = publicKeyProvider.getPublicKey(keyName).join();\n        return new EncryptionKeyInfo(v5Key.key(), v5Key.metadata());\n    }\n\n    @Override\n    public EncryptionKeyInfo getPrivateKey(String keyName, Map<String, String> metadata) {\n        if (privateKeyProvider == null) {\n            throw new UnsupportedOperationException(\n                    \"getPrivateKey called on a producer-side CryptoKeyReaderAdapter\");\n        }\n        var v5Key = privateKeyProvider.getPrivateKey(keyName, metadata).join();\n        return new EncryptionKeyInfo(v5Key.key(), v5Key.metadata());\n    }\n}\n","sourceCodeStart":59,"sourceCodeEnd":84,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client-v5/src/main/java/org/apache/pulsar/client/impl/v5/CryptoKeyReaderAdapter.java#L59-L84","documentation":"This is the mirror of the producer-side case: CryptoKeyReaderAdapter built only with a privateKeyProvider is consumer-side. Calling getPrivateKey (needed for decryption on the consumer) on a producer-side adapter (privateKeyProvider == null) throws UnsupportedOperationException.","triggerScenarios":"Configuring a consumer's decryption with an adapter created from a producer-side key provider (publicKeyProvider only), then the consumer invokes getPrivateKey during message decryption.","commonSituations":"Reusing the producer's CryptoKeyReader for a consumer; defaulting configuration code to the producer factory; one adapter shared across a client used for both producing and consuming.","solutions":["Build the adapter with a non-null privateKeyProvider (consumer-side factory) for consumer decryption.","Give the consumer its own adapter instance with the private key provider.","Verify environment/keystore actually exposes the private keys the consumer needs."],"exampleFix":"// before\nCryptoKeyReader reader = CryptoKeyReaderAdapter.forProducer(publicKeyProvider);\nConsumer<byte[]> c = client.newConsumer().cryptoKeyReader(reader); // consumer needs private keys\n// after\nCryptoKeyReader reader = CryptoKeyReaderAdapter.forConsumer(privateKeyProvider);\nConsumer<byte[]> c = client.newConsumer().cryptoKeyReader(reader);","handlingStrategy":"type-guard","validationCode":"// Ensure the adapter was built for consumers before wiring it into a Consumer\nCryptoKeyReaderAdapter adapter = CryptoKeyReaderAdapter.forConsumer(privateKeyProvider);\nconsumerBuilder.cryptoKeyReader(adapter);","typeGuard":"static boolean supportsPrivateKeys(CryptoKeyReaderAdapter a) {\n    return a != null && a.isConsumerSide(); // or track the factory used at construction\n}","tryCatchPattern":"try {\n    EncryptionKeyInfo ki = adapter.getPrivateKey(keyName, metadata);\n} catch (UnsupportedOperationException e) {\n    throw new IllegalStateException(\"Consumer configured with producer-side key reader\", e);\n}","preventionTips":["Give each client role its own adapter instance.","Verify private keys are available in the environment/keystore for consumers.","Document which factory method maps to which client role in team conventions."],"tags":["encryption","crypto","unsupported-operation"],"backgroundTag":"wrong-crypto-key-reader-role","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}