{"record":{"id":"3dc4c13f61ee7a7c","repo":"apache/pulsar","slug":"malformed-authentication-parameters","errorCode":null,"errorMessage":"Malformed authentication parameters","messagePattern":"Malformed authentication parameters","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/AuthenticationOAuth2.java","lineNumber":197,"sourceCode":"            } else if (authMethod == TokenEndpointAuthMethod.TLS_CLIENT_AUTH) {\n                this.flow = TlsClientAuthFlow.fromParameters(params);\n            } else {\n                throw new IllegalArgumentException(\"Unsupported auth method: \" + authMethod);\n            }\n        } else {\n            throw new IllegalArgumentException(\"Unsupported authentication type: \" + type);\n        }\n    }\n\n    protected Map<String, String> parseAuthParameters(String encodedAuthParamString) {\n        if (StringUtils.isBlank(encodedAuthParamString)) {\n            throw new IllegalArgumentException(\"No authentication parameters were provided\");\n        }\n        Map<String, String> params;\n        try {\n            params = AuthenticationUtil.configureFromJsonString(encodedAuthParamString);\n        } catch (IOException e) {\n            throw new IllegalArgumentException(\"Malformed authentication parameters\", e);\n        }\n\n        String earlyRefreshPercentStr = params.get(CONFIG_PARAM_EARLY_TOKEN_REFRESH_PERCENT);\n        if (earlyRefreshPercentStr != null) {\n            double percent = parseEarlyRefreshPercent(earlyRefreshPercentStr);\n            this.earlyTokenRefreshPercent = percent;\n            if (percent < 1 && this.scheduler == null) {\n                this.scheduler = INTERNAL_SCHEDULER;\n            }\n        }\n        return params;\n    }\n\n    /**\n     * Parses the {@code earlyRefreshPercent} configuration value.\n     *\n     * <p>If the string contains a decimal point it is interpreted as a fractional value in [0, 1]\n     * and used directly (e.g. {@code \"0.8\"} → 0.8). Otherwise the string is treated as an integer","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/AuthenticationOAuth2.java#L179-L215","documentation":"After the blank check, parseAuthParameters() parses the params string as JSON via AuthenticationUtil.configureFromJsonString. If parsing throws IOException (invalid JSON), the exception is rethrown as IllegalArgumentException with message 'Malformed authentication parameters' and the IOException as cause.","triggerScenarios":"Calling configure() with a string that is not valid JSON — e.g. key=value style 'issuerUrl=https://... clientId=...', single quotes instead of double quotes, trailing commas, or truncated JSON.","commonSituations":"Hand-editing the authParams string in client.conf and breaking JSON syntax; using shell env values with unescaped quotes; pasting params from docs that use a non-JSON format.","solutions":["Fix the JSON syntax: double-quoted keys and string values, valid commas, no trailing commas.","Validate the string with a JSON parser (e.g. Jackson) before calling configure().","If your params are in key=value form, convert them to JSON first."],"exampleFix":"// before\nauth.configure(\"issuerUrl=https://auth.example.com clientId=my-client\"); // not JSON -> throws\n// after\nauth.configure(\"{\"issuerUrl\":\"https://auth.example.com\",\"clientId\":\"my-client\",\"clientSecret\":\"s3cret\"}\");","handlingStrategy":"validation","validationCode":"try {\n    new ObjectMapper().readTree(paramsJson); // syntax check only\n} catch (JsonProcessingException e) {\n    throw new IllegalStateException(\"Auth params are not valid JSON: \" + e.getOriginalMessage(), e);\n}\nauth.configure(paramsJson);","typeGuard":null,"tryCatchPattern":"try {\n    auth.configure(paramsJson);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().equals(\"Malformed authentication parameters\")) {\n        log.error(\"Auth params must be valid JSON; cause: {}\", e.getCause());\n        throw new ConfigurationException(\"Fix JSON syntax in auth params\", e);\n    }\n    throw e;\n}","preventionTips":["Always use double-quoted JSON keys/values; no trailing commas.","Validate the string with a JSON parser before configure().","Store params as structured objects in config and serialize at the boundary."],"tags":["pulsar-client","oauth2","json","configuration"],"backgroundTag":"malformed-json-parameters","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}