{"record":{"id":"7e46487fe4228b2f","repo":"GoogleContainerTools/jib","slug":"realm-was-not-found-in-the-www-authenticate-he","errorCode":null,"errorMessage":"'realm' was not found in the 'WWW-Authenticate' header, tried to parse: ${authenticationMethod}","messagePattern":"'realm' was not found in the 'WWW-Authenticate' header, tried to parse: (.+?)","errorType":"exception","errorClass":"RegistryAuthenticationFailedException","httpStatus":null,"severity":"error","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java","lineNumber":92,"sourceCode":"      throws RegistryAuthenticationFailedException {\n    // If the authentication method starts with 'basic' (case insensitive), no registry\n    // authentication is needed.\n    if (authenticationMethod.matches(\"^(?i)(basic).*\")) {\n      return Optional.empty();\n    }\n\n    String registryUrl = registryEndpointRequestProperties.getServerUrl();\n    String imageName = registryEndpointRequestProperties.getImageName();\n    // Checks that the authentication method starts with 'bearer ' (case insensitive).\n    if (!authenticationMethod.matches(\"^(?i)(bearer) .*\")) {\n      throw newRegistryAuthenticationFailedException(\n          registryUrl, imageName, authenticationMethod, \"Bearer\");\n    }\n\n    Pattern realmPattern = Pattern.compile(\"realm=\\\"(.*?)\\\"\");\n    Matcher realmMatcher = realmPattern.matcher(authenticationMethod);\n    if (!realmMatcher.find()) {\n      throw newRegistryAuthenticationFailedException(\n          registryUrl, imageName, authenticationMethod, \"realm\");\n    }\n    String realm = realmMatcher.group(1);\n\n    Pattern servicePattern = Pattern.compile(\"service=\\\"(.*?)\\\"\");\n    Matcher serviceMatcher = servicePattern.matcher(authenticationMethod);\n    // use the provided registry location when missing service (e.g., for OpenShift)\n    String service = serviceMatcher.find() ? serviceMatcher.group(1) : registryUrl;\n\n    return Optional.of(\n        new RegistryAuthenticator(\n            realm, service, registryEndpointRequestProperties, userAgent, httpClient));\n  }\n\n  private static RegistryAuthenticationFailedException newRegistryAuthenticationFailedException(\n      String registry, String repository, String authenticationMethod, String authParam) {\n    return new RegistryAuthenticationFailedException(\n        registry,","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java#L74-L110","documentation":"After confirming the WWW-Authenticate header is a Bearer challenge, Jib extracts the 'realm' parameter to find the token service URL. If the header lacks realm=\"...\", the challenge is malformed and Jib throws a RegistryAuthenticationFailedException including the raw header value.","triggerScenarios":"A registry returns a Bearer WWW-Authenticate header without a realm parameter, e.g. 'Bearer service=\"registry\"' with no realm=\"...\".","commonSituations":"Buggy or partially configured token-auth implementations on private registries; custom auth proxies emitting incomplete challenges; registry software generating non-standard headers.","solutions":["Fix the registry/token service so the Bearer challenge includes realm=\"https://.../token\"","Upgrade or replace the private registry's authentication middleware","Test with curl -v to inspect the WWW-Authenticate header returned by the registry","Point Jib at a spec-compliant registry implementation (Distribution registry:2, cloud registries)"],"exampleFix":"// before (registry challenge)\nWWW-Authenticate: Bearer service=\"myregistry.local\"\n// after\nWWW-Authenticate: Bearer realm=\"https://myregistry.local/service/token\",service=\"myregistry.local\"","handlingStrategy":"validation","validationCode":"HttpURLConnection c = (HttpURLConnection) new URL(\"https://registry/v2/\").openConnection();\nString wwwAuth = c.getHeaderField(\"WWW-Authenticate\");\nif (wwwAuth != null && !wwwAuth.contains(\"realm=\\\"\")) {\n  throw new IllegalStateException(\"Bearer challenge missing realm: \" + wwwAuth);\n}","typeGuard":null,"tryCatchPattern":"try {\n  jibBuild.containerize(...);\n} catch (RegistryAuthenticationException e) {\n  if (e.getMessage().contains(\"'realm' was not found\")) {\n    throw new IllegalStateException(\"Registry token service is misconfigured (no realm)\", e);\n  }\n}","preventionTips":["Configure REGISTRY_AUTH_TOKEN_REALM correctly on registry:2 deployments","Verify the challenge with curl -v after any auth middleware change","Use well-tested token implementations (docker_auth, keycloak gatekeeper)"],"tags":["registry","authentication","docker","www-authenticate"],"backgroundTag":"authentication-required","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}