{"record":{"id":"511381a7b7b7628f","repo":"apache/pulsar","slug":"no-authorization-providers-are-present","errorCode":null,"errorMessage":"No authorization providers are present.","messagePattern":"No authorization providers are present\\.","errorType":"exception","errorClass":"PulsarServerException","httpStatus":null,"severity":"critical","filePath":"pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/AuthorizationService.java","lineNumber":77,"sourceCode":"public class AuthorizationService {\n\n    private final PulsarResources resources;\n    private final AuthorizationProvider provider;\n    private final ServiceConfiguration conf;\n\n    public AuthorizationService(ServiceConfiguration conf, PulsarResources pulsarResources)\n            throws PulsarServerException {\n        this.conf = conf;\n        try {\n            final String providerClassname = conf.getAuthorizationProvider();\n            if (StringUtils.isNotBlank(providerClassname)) {\n                provider = (AuthorizationProvider) Class.forName(providerClassname)\n                        .getDeclaredConstructor().newInstance();\n                provider.initialize(conf, pulsarResources);\n                this.resources = pulsarResources;\n                log.info().attr(\"providerClassname\", providerClassname).log(\"Loaded authorization provider\");\n            } else {\n                throw new PulsarServerException(\"No authorization providers are present.\");\n            }\n        } catch (PulsarServerException e) {\n            throw e;\n        } catch (Throwable e) {\n            throw new PulsarServerException(\"Failed to load an authorization provider.\", e);\n        }\n    }\n\n    public CompletableFuture<Boolean> isSuperUser(AuthenticationParameters authParams) {\n        if (!isValidOriginalPrincipal(authParams)) {\n            return CompletableFuture.completedFuture(false);\n        }\n        if (isProxyRole(authParams.getClientRole()) && !isWebsocketPrinciple(authParams.getOriginalPrincipal())) {\n            CompletableFuture<Boolean> isRoleAuthorizedFuture = isSuperUser(authParams.getClientRole(),\n                    authParams.getClientAuthenticationDataSource());\n            // The current paradigm is to pass the client auth data when we don't have access to the original auth data.\n            CompletableFuture<Boolean> isOriginalAuthorizedFuture = isSuperUser(authParams.getOriginalPrincipal(),\n                    authParams.getClientAuthenticationDataSource());","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/AuthorizationService.java#L59-L95","documentation":"AuthorizationService's constructor throws PulsarServerException when no authorization provider class is configured (the providerClassname branch is skipped), meaning the broker cannot perform any authorization checks.","triggerScenarios":"Starting a broker with `authorizationEnabled=true` but without setting `authorizationProvider` to a class implementing AuthorizationProvider.","commonSituations":"Operators enable authorization in broker.conf but rely on a default provider class that is not wired in this code path; config file missing the authorizationProvider key after an upgrade or template change.","solutions":["Set `authorizationProvider=org.apache.pulsar.broker.authorization.PulsarAuthorizationProvider` in broker.conf.","If using a custom provider, give its fully-qualified class name and ensure its jar is on the broker's classpath.","If you don't need authorization, set `authorizationEnabled=false` so this path is not exercised."],"exampleFix":"# before (broker.conf)\nauthorizationEnabled=true\n# after\nauthorizationEnabled=true\nauthorizationProvider=org.apache.pulsar.broker.authorization.PulsarAuthorizationProvider","handlingStrategy":"validation","validationCode":"// pre-start check\nString provider = config.getAuthorizationProvider();\nboolean enabled = config.isAuthorizationEnabled();\nif (enabled && (provider == null || provider.isBlank()))\n    throw new IllegalStateException(\"authorizationEnabled requires authorizationProvider to be set\");","typeGuard":"boolean authConfigComplete(ServiceConfiguration c) { return !c.isAuthorizationEnabled() || (c.getAuthorizationProvider() != null && !c.getAuthorizationProvider().isBlank()); }","tryCatchPattern":"try { new AuthorizationService(conf, resources); } catch (PulsarServerException e) { log.error(\"broker cannot start: {}\", e.getMessage()); throw e; }","preventionTips":["Set authorizationProvider explicitly whenever authorizationEnabled=true","Keep broker.conf templates complete when upgrading","Smoke-test broker startup in CI with production-like config"],"tags":["authorization","configuration","broker-startup","java"],"backgroundTag":"missing-authorization-provider","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}