{"record":{"id":"71485851f8384c2c","repo":"apache/pulsar","slug":"no-token","errorCode":"NO_TOKEN","errorMessage":"Authentication data source does not have a role token","messagePattern":"Authentication data source does not have a role token","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java","lineNumber":125,"sourceCode":"        SocketAddress clientAddress;\n        String roleToken;\n        ErrorCode errorCode = ErrorCode.UNKNOWN;\n        try {\n\n            if (authData.hasDataFromPeer()) {\n                clientAddress = authData.getPeerAddress();\n            } else {\n                errorCode = ErrorCode.NO_CLIENT;\n                throw new AuthenticationException(\"Authentication data source does not have a client address\");\n            }\n\n            if (authData.hasDataFromCommand()) {\n                roleToken = authData.getCommandData();\n            } else if (authData.hasDataFromHttp()) {\n                roleToken = authData.getHttpHeader(AuthZpeClient.ZPE_TOKEN_HDR);\n            } else {\n                errorCode = ErrorCode.NO_TOKEN;\n                throw new AuthenticationException(\"Authentication data source does not have a role token\");\n            }\n\n            if (roleToken == null) {\n                errorCode = ErrorCode.NO_TOKEN;\n                throw new AuthenticationException(\"Athenz token is null, can't authenticate\");\n            }\n            if (roleToken.isEmpty()) {\n                errorCode = ErrorCode.NO_TOKEN;\n                throw new AuthenticationException(\"Athenz RoleToken is empty, Server is Using Athenz Authentication\");\n            }\n                log.debug().attr(\"roleToken\", roleToken)\n                        .attr(\"clientAddress\", clientAddress)\n                        .log(\"Athenz RoleToken received from Client\");\n\n            RoleToken token = new RoleToken(roleToken);\n\n            if (!domainNameList.contains(token.getDomain())) {\n                errorCode = ErrorCode.DOMAIN_MISMATCH;","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java#L107-L143","documentation":"authenticate() extracts the Athenz role token either from the command payload or from the ZPE HTTP header. If the AuthenticationDataSource has neither command data nor HTTP data, errorCode NO_TOKEN is set and this AuthenticationException is thrown: there is no credential at all to verify.","triggerScenarios":"Client connects without sending the Athenz token in the auth data (Authenticate command data empty) or HTTP request lacks the ZPE token header.","commonSituations":"Client not configured with Athenz credentials while broker requires athenz provider; proxy stripping the ZPE_TOKEN_HDR header; using a client library that doesn't forward the token on initial connect.","solutions":["Configure the client's authentication plugin/parameters to supply the Athenz role token.","If HTTP, ensure the ZPE token header (per AuthZpeClient.ZPE_TOKEN_HDR) is present and not stripped by proxies/LBs.","Verify the broker's authenticationProviders list matches the client's auth method."],"exampleFix":"// before\nclient --auth-plugin skip --broker requiring athenz\n// after\nbin/pulsar-client --url pulsar://host:6650 \\\n  --auth-plugin org.apache.pulsar.client.impl.auth.AuthenticationAthenz \\\n  --auth-params '{\"roleToken\":\"...\"}'","handlingStrategy":"validation","validationCode":"// client side, before connecting\nboolean hasCred = authParams != null && (authParams.containsKey(\"roleToken\") || !authToken.isEmpty());\nif (!hasCred) throw new IllegalArgumentException(\"Athenz role token required\");","typeGuard":null,"tryCatchPattern":"try {\n    principal = provider.authenticate(authData);\n} catch (AuthenticationException e) {\n    // NO_TOKEN: client sent no credential — reject with auth challenge\n    throw new AuthenticationException(\"no role token supplied\", e);\n}","preventionTips":["Configure the client's athenz auth plugin with a real role token.","Ensure proxies/LBs forward the ZPE token header.","Match client auth method to broker's authenticationProviders."],"tags":["athenz","authentication","missing-token","role-token"],"backgroundTag":"missing-auth-credentials","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}