{"record":{"id":"51885934f360de3f","repo":"apache/pulsar","slug":"issuer-mismatch","errorCode":"ISSUER_MISMATCH","errorMessage":"Issuer URL mismatch: [%s] should match [%s]","messagePattern":"Issuer URL mismatch: \\[(.+?)\\] should match \\[(.+?)\\]","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/OpenIDProviderMetadataCache.java","lineNumber":235,"sourceCode":"     * Per the OpenID Connect Discovery spec, the issuer value returned MUST be identical to the\n     * Issuer URL that was directly used to retrieve the configuration information. This MUST also\n     * be identical to the iss Claim value in ID Tokens issued from this Issuer.\n     * https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation\n     *\n     * @param issuer - the issuer used to retrieve the metadata\n     * @param metadata - the OpenID Provider Metadata\n     * @param isK8s - whether the issuer is represented by the Kubernetes API server. This affects error reporting.\n     * @throws AuthenticationException if the issuer does not exactly match the metadata issuer\n     */\n    private void verifyIssuer(@NonNull String issuer, OpenIDProviderMetadata metadata,\n                              boolean isK8s) throws AuthenticationException {\n        if (!issuer.equals(metadata.getIssuer())) {\n            if (isK8s) {\n                authenticationProvider.incrementFailureMetric(AuthenticationExceptionCode.UNSUPPORTED_ISSUER);\n                throw new AuthenticationException(\"Issuer not allowed: \" + issuer);\n            } else {\n                authenticationProvider.incrementFailureMetric(AuthenticationExceptionCode.ISSUER_MISMATCH);\n                throw new AuthenticationException(String.format(\"Issuer URL mismatch: [%s] should match [%s]\",\n                        issuer, metadata.getIssuer()));\n            }\n        }\n    }\n}\n","sourceCodeStart":217,"sourceCodeEnd":241,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/OpenIDProviderMetadataCache.java#L217-L241","documentation":"OpenID Connect metadata validation: the issuer returned in the discovered provider metadata is not identical to the issuer URL used to fetch it, violating the OIDC Discovery spec, so the metadata is rejected as potentially malicious/misconfigured.","triggerScenarios":"Thrown at pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/OpenIDProviderMetadataCache.java:235 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Correct the broker's issuer URL to exactly match the provider's advertised issuer","Fix the OIDC provider configuration so its metadata issuer matches the discovery endpoint"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}