{"record":{"id":"1791c64ad9291fc7","repo":"apache/pulsar","slug":"failed-to-parse-sasl-authparams","errorCode":null,"errorMessage":"Failed to parse SASL authParams","messagePattern":"Failed to parse SASL authParams","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client-auth-sasl/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationSasl.java","lineNumber":311,"sourceCode":"        }\n\n        @Override\n        public AuthenticationDataProvider create(String brokerHost) throws Exception {\n            return shim.getAuthData(brokerHost);\n        }\n    }\n\n    @Override\n    public void configure(String encodedAuthParamString) {\n        if (isBlank(encodedAuthParamString)) {\n            log.info().attr(\"defaultSectionName\", JAAS_DEFAULT_CLIENT_SECTION_NAME)\n                    .log(\"authParams for SASL is empty, will use default JAAS client section name\");\n        }\n\n        try {\n            setAuthParams(AuthenticationUtil.configureFromJsonString(encodedAuthParamString));\n        } catch (IOException e) {\n            throw new IllegalArgumentException(\"Failed to parse SASL authParams\", e);\n        }\n    }\n\n    @Override\n    @Deprecated\n    public void configure(Map<String, String> authParams) {\n        try {\n            setAuthParams(authParams);\n        }  catch (IOException e) {\n            throw new IllegalArgumentException(\"Failed to parse SASL authParams\", e);\n        }\n    }\n\n    // use passed in parameter to config ange get jaasCredentialsContainer.\n    private void setAuthParams(Map<String, String> authParams) throws PulsarClientException {\n        this.configuration = authParams;\n\n        // read section from config files of kerberos","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client-auth-sasl/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationSasl.java#L293-L329","documentation":"AuthenticationSasl.configure(String) parses the encoded authParams string as JSON via AuthenticationUtil.configureFromJsonString(); an IOException during parsing is rethrown as IllegalArgumentException with this message. The authParams string must be a valid JSON object of key/value pairs (e.g. {\"jaasClientSection\":\"...\"}).","triggerScenarios":"Passing a malformed JSON string as the authParamString — e.g. missing quotes, unescaped characters, or passing a properties-style string like 'jaasClientSection=foo' instead of JSON.","commonSituations":"Configuring authParams in client configuration files or URLs where the value got mangled (shell quoting, YAML/properties interpolation); copying Kerberos-style config syntax instead of the JSON format Pulsar expects; passing a file path rather than JSON content.","solutions":["Validate the authParams string is well-formed JSON (e.g. parse it with a JSON parser) before passing it to configure().","Use the JSON form: {\"jaasClientSection\":\"PulsarClient\"} rather than key=value syntax.","If config comes from a file/URL, load and inline the JSON content; do not pass the path.","Check shell/framework escaping — quotes in JSON often get stripped by properties files or command lines."],"exampleFix":"// before\nauth.configure(\"jaasClientSection=PulsarClient\"); // IllegalArgumentException\n// after\nauth.configure(\"{\\\"jaasClientSection\\\":\\\"PulsarClient\\\"}\");","handlingStrategy":"validation","validationCode":"// Java: validate JSON before calling configure(String)\nimport com.fasterxml.jackson.databind.ObjectMapper;\nprivate static final ObjectMapper MAPPER = new ObjectMapper();\nstatic void validateSaslAuthParams(String s) {\n    try { MAPPER.readTree(s).fields(); }\n    catch (Exception e) { throw new IllegalArgumentException(\"authParams is not valid JSON\", e); }\n}","typeGuard":null,"tryCatchPattern":"try {\n    auth.configure(encodedAuthParamString);\n} catch (IllegalArgumentException e) {\n    log.error(\"Bad SASL authParams JSON: {}\", e.getMessage(), e.getCause());\n    throw new ConfigException(\"Fix authParams to be a JSON object\", e);\n}","preventionTips":["Store authParams as JSON objects, never key=value properties syntax.","Test-parse the JSON with Jackson before deployment.","Watch shell/YAML quoting that strips double quotes from JSON values.","If a file holds the params, read and inline its contents, not the path."],"tags":["configuration","json","sasl","parsing"],"backgroundTag":"invalid-auth-params","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}