{"record":{"id":"20d441a6fde0e541","repo":"apache/hadoop","slug":"public-key-for-signature-validation-must-be-provis","errorCode":null,"errorMessage":"Public key for signature validation must be provisioned.","messagePattern":"Public key for signature validation must be provisioned\\.","errorType":"exception","errorClass":"ServletException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/JWTRedirectAuthenticationHandler.java","lineNumber":125,"sourceCode":"   *           thrown if the handler could not be initialized.\n   */\n  @Override\n  public void init(Properties config) throws ServletException {\n    super.init(config);\n    // setup the URL to redirect to for authentication\n    authenticationProviderUrl = config\n        .getProperty(AUTHENTICATION_PROVIDER_URL);\n    if (authenticationProviderUrl == null) {\n      throw new ServletException(\n          \"Authentication provider URL must not be null - configure: \"\n              + AUTHENTICATION_PROVIDER_URL);\n    }\n\n    // setup the public key of the token issuer for verification\n    if (publicKey == null) {\n      String pemPublicKey = config.getProperty(PUBLIC_KEY_PEM);\n      if (pemPublicKey == null) {\n        throw new ServletException(\n            \"Public key for signature validation must be provisioned.\");\n      }\n      publicKey = CertificateUtil.parseRSAPublicKey(pemPublicKey);\n    }\n    // setup the list of valid audiences for token validation\n    String auds = config.getProperty(EXPECTED_JWT_AUDIENCES);\n    if (auds != null) {\n      // parse into the list\n      String[] audArray = auds.split(\",\");\n      audiences = new ArrayList<String>();\n      for (String a : audArray) {\n        audiences.add(a);\n      }\n    }\n\n    // setup custom cookie name if configured\n    String customCookieName = config.getProperty(JWT_COOKIE_NAME);\n    if (customCookieName != null) {","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/JWTRedirectAuthenticationHandler.java#L107-L143","documentation":"Error \"Public key for signature validation must be provisioned.\" thrown in apache/hadoop.","triggerScenarios":"Raised at runtime when the documented precondition or configuration requirement for this operation is violated.","commonSituations":"Misconfigured or missing property, invalid user input, or calling the API before its prerequisites are met.","solutions":["Provision the expected public key (or certificate) for JWT signature validation through the filter's public key configuration before enabling JWT authentication."],"exampleFix":"Set the public key PEM in the JWTRedirectAuthenticationHandler config.","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}