{"record":{"id":"32ec48b841edaa6f","repo":"apache/pulsar","slug":"error-caching-authentication-data-for-s-s-s-32ec48","errorCode":null,"errorMessage":"Error caching authentication data for %s %s:- %s","messagePattern":"Error caching authentication data for (.+?) (.+?):- (.+?)","errorType":"http","errorClass":"RestException","httpStatus":500,"severity":"error","filePath":"pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/SinksImpl.java","lineNumber":226,"sourceCode":"                        try {\n                            Optional<FunctionAuthData> functionAuthData = functionAuthProvider\n                                    .cacheAuthData(finalFunctionDetails,\n                                            authParams.getClientAuthenticationDataSource());\n\n                            functionAuthData.ifPresent(authData ->\n                                    functionMetaDataObj.setFunctionAuthSpec()\n                                            .setData(authData.getData()));\n                        } catch (Exception e) {\n                            log.error().attr(\"componentType\", ComponentTypeUtils.toString(componentType))\n\n                                    .attr(\"tenant\", tenant).attr(\"namespace\", namespace)\n\n                                    .attr(\"componentName\", sinkName).exception(e)\n\n                                    .log(\"Error caching authentication data for / /\");\n\n\n                            throw new RestException(Response.Status.INTERNAL_SERVER_ERROR,\n                                    String.format(\"Error caching authentication data for %s %s:- %s\",\n                                            ComponentTypeUtils.toString(componentType), sinkName, e.getMessage()));\n                        }\n                    }\n                });\n            }\n\n            PackageLocationMetaData packageLocationMetaData;\n            try {\n                packageLocationMetaData = getFunctionPackageLocation(functionMetaDataObj,\n                        sinkPkgUrl, fileDetail, componentPackageFile);\n            } catch (Exception e) {\n                log.error().attr(\"componentType\", ComponentTypeUtils.toString(componentType)).attr(\"tenant\", tenant)\n\n                        .attr(\"namespace\", namespace).attr(\"componentName\", sinkName).exception(e)\n\n                        .log(\"Failed process / / package\");\n                throw new RestException(Response.Status.INTERNAL_SERVER_ERROR, e.getMessage());","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/SinksImpl.java#L208-L244","documentation":"When worker authentication is enabled and the configured function auth provider supports caching client credentials, registerSink tries cacheAuthData(...) to store auth data for the sink's runtime. Any exception there becomes HTTP 500 'Error caching authentication data for Sink <name>:- <reason>'. This is a server-side storage/provider failure, not a problem with the sink code itself.","triggerScenarios":"registerSink on a worker with authenticationEnabled=true and a functionAuthProvider configured, where the provider fails to serialize/store the client AuthenticationDataSource (e.g. backing store unavailable, unsupported credential type, serialization error).","commonSituations":"Misconfigured FunctionAuthProvider in worker.conf; auth data source type not supported by the provider; state store/BookKeeper used for function auth data unreachable; token-based credentials missing/expired on the client.","solutions":["Inspect the '- ' message and worker logs for the provider's root cause.","Verify the client supplied valid credentials (AuthenticationDataSource non-null and of a supported type).","Check the auth data backing store used by the runtime factory's provider is reachable and writable.","If function-runtime auth caching is not needed, disable/unset the functionAuthProvider in worker.conf or run with authentication consistent with cluster policy."],"exampleFix":"// worker.conf before: provider set but backing store wrong\nfunctionAuthProvider=org.apache.pulsar.functions.auth.KubernetesFunctionAuthProvider\n// after: align with runtime or disable\nfunctionRuntimeFactoryDependencies=...\n# use matching config for k8s auth secret storage or omit functionAuthProvider when auth caching is unnecessary","handlingStrategy":"try-catch","validationCode":"if (authParams == null || authParams.getClientAuthenticationDataSource() == null) {\n  // worker will skip caching; ensure your cluster policy allows that\n}","typeGuard":null,"tryCatchPattern":"try { admin.sinks().createSink(cfg, archive); } catch (PulsarAdminException e) { if (e.getStatusCode() == 500 && e.getMessage().contains(\"Error caching authentication data\")) { /* inspect provider config / credentials, not the sink code */ } }","preventionTips":["Supply valid client credentials so the AuthenticationDataSource is populated","Ensure the configured FunctionAuthProvider's backing store is reachable from workers","Keep functionAuthProvider consistent with the runtime factory in worker.conf","Treat this 500 as infrastructure/config, not a sink artifact problem"],"tags":["rest-api","authentication","pulsar-functions","internal-server-error"],"backgroundTag":"auth-data-cache-failure","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}