{"record":{"id":"63342544f241bd8d","repo":"apache/pulsar","slug":"no-athenz-domain-name-specified","errorCode":null,"errorMessage":"No athenz domain name specified","messagePattern":"No athenz domain name specified","errorType":"console","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java","lineNumber":74,"sourceCode":"    }\n\n    @Override\n    public void initialize(ServiceConfiguration config) throws IOException {\n        initialize(Context.builder().config(config).build());\n    }\n\n    @Override\n    public void initialize(Context context) throws IOException {\n        authenticationMetrics = new AuthenticationMetrics(context.getOpenTelemetry(),\n                getClass().getSimpleName(), getAuthMethodName());\n        var config = context.getConfig();\n        String domainNames;\n        if (config.getProperty(DOMAIN_NAME_LIST) != null) {\n            domainNames = (String) config.getProperty(DOMAIN_NAME_LIST);\n        } else if (!StringUtils.isEmpty(System.getProperty(SYS_PROP_DOMAIN_NAME_LIST))) {\n            domainNames = System.getProperty(SYS_PROP_DOMAIN_NAME_LIST);\n        } else {\n            throw new IOException(\"No athenz domain name specified\");\n        }\n\n        domainNameList = Lists.newArrayList(domainNames.split(\",\"));\n        log.info().attr(\"domainNames\", domainNameList).log(\"Supported domain names for Athenz\");\n\n        if (!StringUtils.isEmpty(System.getProperty(SYS_PROP_ALLOWED_OFFSET))) {\n            try {\n                allowedOffset = Integer.parseInt(System.getProperty(SYS_PROP_ALLOWED_OFFSET));\n            } catch (NumberFormatException e) {\n                throw new IOException(\"Invalid allowed offset for athenz role token verification specified\", e);\n            }\n\n            if (allowedOffset < 0) {\n                throw new IOException(\"Allowed offset for athenz role token verification must not be negative\");\n            }\n        }\n\n        log.info().attr(\"allowedOffsetSeconds\", allowedOffset).log(\"Allowed offset for athenz role token verification\");","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java#L56-L92","documentation":"AuthenticationProviderAthenz.initialize() requires the set of allowed Athenz domain names. It reads them from the config property DOMAIN_NAME_LIST, falling back to the system property SYS_PROP_DOMAIN_NAME_LIST; if neither is set it throws this IOException, meaning the provider cannot be initialized because it would have no domains to accept tokens for.","triggerScenarios":"Broker starts with authProvider enabled (athenz) but neither configServiceProperty DOMAIN_NAME_LIST nor system property (athenz domain name list sysprop) is configured.","commonSituations":"Misconfigured broker.conf missing the athenz domain list property; operator set the property name with wrong casing/typo; deploying with authenticationEnabled=true but forgetting provider-specific settings.","solutions":["Set the Athenz domain list in the broker config, e.g. add the DOMAIN_NAME_LIST property to broker.conf (comma-separated domain names).","Alternatively set the JVM system property (e.g. -Dpulse.athenz.domain.names=dom1,dom2 per the provider's SYS_PROP constant) on the broker command line.","Verify the property key spelling matches the provider constants exactly.","Disable the athenz authentication provider if Athenz is not actually used."],"exampleFix":"# before (broker.conf)\nauthenticationEnabled=true\nauthenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderAthenz\n\n# after\nauthenticationEnabled=true\nauthenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderAthenz\nathenzDomainNames=core.domain1,core.domain2","handlingStrategy":"validation","validationCode":"// before broker start\nString domains = System.getProperty(ATHENZ_SYS_PROP_DOMAIN_NAME_LIST);\nboolean configSet = brokerConfigProperties.getProperty(\"athenzDomainNames\") != null;\nif (domains == null || domains.isEmpty()) { /* fail fast with clear message */ }","typeGuard":null,"tryCatchPattern":"try {\n    provider.initialize(config);\n} catch (IOException e) {\n    if (e.getMessage().contains(\"No athenz domain name specified\")) {\n        log.error(\"Set athenzDomainNames in broker.conf or the system property\");\n    }\n    throw e;\n}","preventionTips":["Add athenzDomainNames to broker.conf whenever the athenz provider is enabled.","Smoke-test broker startup in CI with the provider enabled to catch missing config.","Keep provider config keys in one templated config file to avoid typos."],"tags":["athenz","authentication","configuration","startup"],"backgroundTag":"missing-config-property","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}