{"record":{"id":"5e810cb534879160","repo":"apache/pulsar","slug":"illegal-auth-action-action-possible-values","errorCode":null,"errorMessage":"Illegal auth action '${action}'. Possible values: ${Arrays.toString(AuthAction.values())}","messagePattern":"Illegal auth action '(.+?)'\\. Possible values: (.+?)","errorType":"validation","errorClass":"ParameterException","httpStatus":null,"severity":"error","filePath":"pulsar-client-tools/src/main/java/org/apache/pulsar/admin/cli/CliCommand.java","lineNumber":91,"sourceCode":"    static MessageId validateMessageIdString(String resetMessageIdStr, int partitionIndex) throws PulsarAdminException {\n        String[] messageId = resetMessageIdStr.split(\":\");\n        try {\n            com.google.common.base.Preconditions.checkArgument(messageId.length == 2);\n            return new MessageIdImpl(Long.parseLong(messageId[0]), Long.parseLong(messageId[1]), partitionIndex);\n        } catch (Exception e) {\n            throw new PulsarAdminException(\n                    \"Invalid message id (must be in format: ledgerId:entryId) value \" + resetMessageIdStr);\n        }\n    }\n\n    Set<AuthAction> getAuthActions(List<String> actions) {\n        Set<AuthAction> res = new TreeSet<>();\n        AuthAction authAction;\n        for (String action : actions) {\n            try {\n                authAction = AuthAction.valueOf(action);\n            } catch (IllegalArgumentException exception) {\n                throw new ParameterException(String.format(\"Illegal auth action '%s'. Possible values: %s\",\n                        action, Arrays.toString(AuthAction.values())));\n            }\n            res.add(authAction);\n        }\n\n        return res;\n    }\n\n    <T> void print(List<T> items) {\n        for (T item : items) {\n            print(item);\n        }\n    }\n\n    <K, V> void print(Map<K, V> items) {\n        for (Map.Entry<K, V> entry : items.entrySet()) {\n            print(entry.getKey() + \"    \" + entry.getValue());\n        }","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client-tools/src/main/java/org/apache/pulsar/admin/cli/CliCommand.java#L73-L109","documentation":"The pulsar-admin CLI's getAuthActions option parser converts each --actions value to the AuthAction enum via AuthAction.valueOf(). When a value is not an exact enum constant name, JCommander's ParameterException is thrown listing all valid values. This guards the sink/source/publish permission API against typo'd action names.","triggerScenarios":"Running commands like 'pulsar-admin namespaces grant-permission' or 'permissions grant' with --actions containing a string that is not exactly one of produce, consume, or functions (case-sensitive).","commonSituations":"Typing lowercase/pluralized variants ('read', 'write', 'admin'), copying actions from other systems (Kafka ACLs), or forgetting that enum names are case-sensitive and comma-separated values must be valid individually.","solutions":["Use one of the exact AuthAction values listed in the message (e.g. produce, consume, functions), matching case exactly.","Pass multiple actions as repeated/whitespace-separated arguments (e.g. --actions produce --actions consume) rather than inventing names.","Check AuthAction enum constants in org.apache.pulsar.common.policies.data.AuthAction for the authoritative list on your Pulsar version."],"exampleFix":"// before\npulsar-admin namespaces grant-permission my-namespace --role app1 --actions read\n// after\npulsar-admin namespaces grant-permission my-namespace --role app1 --actions consume","handlingStrategy":"validation","validationCode":"Set<String> VALID = Set.of(\"produce\", \"consume\", \"functions\");\nif (!VALID.contains(action)) {\n    throw new IllegalArgumentException(\"action must be one of \" + VALID + \": got \" + action);\n}","typeGuard":null,"tryCatchPattern":"try {\n    admin.namespaces().grantPermission(ns, role, EnumSet.of(AuthAction.valueOf(action)));\n} catch (IllegalArgumentException e) {\n    System.err.println(\"Invalid auth action '\" + action + \"'; valid: \" + Arrays.toString(AuthAction.values()));\n}","preventionTips":["Reference AuthAction constants directly instead of hand-writing strings.","Remember enum names are case-sensitive: produce, consume, functions.","Print AuthAction.values() when generating scripts for users."],"tags":["cli","auth","validation","pulsar-admin"],"backgroundTag":"invalid-enum-value","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}