{"record":{"id":"21712401c1ba2b69","repo":"apache/pulsar","slug":"unauthorized-to-validatetopicpolicyoperation-for-o","errorCode":null,"errorMessage":"Unauthorized to validateTopicPolicyOperation for operation [%s] on topic [%s] on policy [%s]","messagePattern":"Unauthorized to validateTopicPolicyOperation for operation \\[(.+?)\\] on topic \\[(.+?)\\] on policy \\[(.+?)\\]","errorType":"http","errorClass":"RestException","httpStatus":403,"severity":"error","filePath":"pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java","lineNumber":1244,"sourceCode":"    }\n\n    public void validateTopicPolicyOperation(TopicName topicName, PolicyName policy, PolicyOperation operation) {\n        sync(()-> validateTopicPolicyOperationAsync(topicName, policy, operation));\n    }\n\n    public CompletableFuture<Void> validateTopicPolicyOperationAsync(TopicName topicName,\n                                                                     PolicyName policy, PolicyOperation operation) {\n        if (pulsar().getConfiguration().isAuthenticationEnabled()\n                && pulsar().getBrokerService().isAuthorizationEnabled()) {\n            if (!isClientAuthenticated(clientAppId())) {\n                return FutureUtil.failedFuture(\n                        new RestException(Status.FORBIDDEN, \"Need to authenticate to perform the request\"));\n            }\n            return pulsar().getBrokerService().getAuthorizationService()\n                    .allowTopicPolicyOperationAsync(topicName, policy, operation, originalPrincipal(), clientAppId(),\n                            clientAuthData()).thenAccept(isAuthorized -> {\n                        if (!isAuthorized) {\n                            throw new RestException(Status.FORBIDDEN,\n                                    String.format(\"Unauthorized to validateTopicPolicyOperation\"\n                                            + \" for operation [%s] on topic [%s] on policy [%s]\", operation.toString(),\n                                    topicName, policy.toString()));\n                        }\n                    });\n        }\n        return CompletableFuture.completedFuture(null);\n    }\n\n    public CompletableFuture<Void> validateTopicOperationAsync(TopicName topicName, TopicOperation operation) {\n       return validateTopicOperationAsync(topicName, operation, null);\n    }\n\n    public CompletableFuture<Void> validateTopicOperationAsync(TopicName topicName,\n                                                               TopicOperation operation, String subscription) {\n        if (pulsar().getConfiguration().isAuthenticationEnabled()\n                && pulsar().getBrokerService().isAuthorizationEnabled()) {\n            if (!isClientAuthenticated(clientAppId())) {","sourceCodeStart":1226,"sourceCodeEnd":1262,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java#L1226-L1262","documentation":"Authorization check failure in validateTopicPolicyOperationAsync: the authenticated role is not permitted to perform the requested policy operation on the topic; the authorization manager denied the check and the forbidden error is thrown.","triggerScenarios":"Thrown at pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java:1244 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Grant the role the required policy permission via grant-permission","Verify the client is authenticating with the expected role"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}