{"record":{"id":"41be92fed9b2daea","repo":"apache/pulsar","slug":"not-supported","errorCode":null,"errorMessage":"Not supported","messagePattern":"Not supported","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/AuthenticationStateOpenID.java","lineNumber":63,"sourceCode":"            SSLSession sslSession) {\n        this.provider = provider;\n        this.remoteAddress = remoteAddress;\n        this.sslSession = sslSession;\n    }\n\n    @Override\n    public String getAuthRole() throws AuthenticationException {\n        if (role == null) {\n            throw new AuthenticationException(\"Authentication has not completed\");\n        }\n        return role;\n    }\n\n    @Deprecated\n    @Override\n    public AuthData authenticate(AuthData authData) throws AuthenticationException {\n        // This method is not expected to be called and is subject to removal.\n        throw new AuthenticationException(\"Not supported\");\n    }\n\n    @Override\n    public CompletableFuture<AuthData> authenticateAsync(AuthData authData) {\n        final String token = new String(authData.getBytes(), UTF_8);\n        this.authenticationDataSource = new AuthenticationDataCommand(token, remoteAddress, sslSession);\n        return provider\n                .authenticateTokenAsync(authenticationDataSource)\n                .thenApply(jwt -> {\n                    this.role = provider.getRole(jwt);\n                    // OIDC requires setting the exp claim, so this should never be null.\n                    // We verify it is not null during token validation.\n                    this.expiration = jwt.getExpiresAt().getTime();\n                    // Single stage authentication, so return null here\n                    return null;\n                });\n    }\n","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/AuthenticationStateOpenID.java#L45-L81","documentation":"AuthenticationStateOpenID implements only the asynchronous authenticateAsync() path; the deprecated synchronous AuthenticationState.authenticate(AuthData) method is deliberately unsupported and always throws AuthenticationException(\"Not supported\"). Token validation for OIDC involves async I/O (discovery and JWKS fetching), so the provider only supports the async API and the sync method is a placeholder slated for removal.","triggerScenarios":"Any code path that calls the deprecated AuthenticationState.authenticate(AuthData) on an AuthenticationStateOpenID instance — typically legacy broker/framework code or custom plugins written against the pre-async API, or test code invoking the sync method directly (as in authenticateShouldThrowNotImplementedException).","commonSituations":"Running an older Pulsar broker or third-party authentication interceptor that still drives the deprecated synchronous AuthenticationState API; custom ProtocolHandler or PulsarProxy code that was not migrated to authenticateAsync; unit tests asserting the method stays unimplemented.","solutions":["Migrate the calling code to use authenticateAsync(AuthData) and handle the returned CompletableFuture instead of the sync authenticate().","If the caller is framework code you cannot change, upgrade Pulsar/the component to a version where the async API is used for OIDC authentication.","In your own code, stop overriding/calling the deprecated method; treat AuthenticationStateOpenID as async-only."],"exampleFix":"// before\nAuthData response = authState.authenticate(authData);\n// after\nauthState.authenticateAsync(authData)\n    .thenAccept(response -> { /* continue handshake */ })\n    .exceptionally(ex -> { /* handle auth failure */ return null; });","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    authState.authenticate(authData); // deprecated, throws for OIDC\n} catch (AuthenticationException e) {\n    // fall back to the async API\n    authState.authenticateAsync(authData).whenComplete((resp, ex) -> { /* ... */ });\n}","preventionTips":["Use authenticateAsync() exclusively with OIDC authentication states.","Enable deprecation warnings and treat AuthenticationState.authenticate() usages as build errors.","When writing plugins, target the async AuthenticationState API."],"tags":["authentication","oidc","deprecated-api","async","java"],"backgroundTag":"operation-not-supported","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}