{"record":{"id":"7e816ca2152ba28a","repo":"apache/pulsar","slug":"invalid-proxy-configuration-authentication-must-b","errorCode":null,"errorMessage":"Invalid proxy configuration. Authentication must be enabled with authenticationEnabled=true when authorization is enabled with authorizationEnabled=true.","messagePattern":"Invalid proxy configuration\\. Authentication must be enabled with authenticationEnabled=true when authorization is enabled with authorizationEnabled=true\\.","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/ProxyService.java","lineNumber":269,"sourceCode":"                proxyConfig.getMaxConcurrentInboundConnections(),\n                proxyConfig.getMaxConcurrentInboundConnectionsPerIp());\n\n        this.openTelemetry = new PulsarProxyOpenTelemetry(proxyConfig);\n\n        // Initialize topic list memory limiter\n        this.maxTopicListInFlightLimiter = new TopicListMemoryLimiter(\n                CollectorRegistry.defaultRegistry, \"pulsar_proxy_\", openTelemetry.getMeter(),\n                proxyConfig.getMaxTopicListInFlightHeapMemSizeMB() * 1024L * 1024L,\n                proxyConfig.getMaxTopicListInFlightHeapMemSizePermitsAcquireQueueSize(),\n                proxyConfig.getMaxTopicListInFlightHeapMemSizePermitsAcquireTimeoutMillis(),\n                proxyConfig.getMaxTopicListInFlightDirectMemSizeMB() * 1024L * 1024L,\n                proxyConfig.getMaxTopicListInFlightDirectMemSizePermitsAcquireQueueSize(),\n                proxyConfig.getMaxTopicListInFlightDirectMemSizePermitsAcquireTimeoutMillis());\n    }\n\n    public void start() throws Exception {\n        if (proxyConfig.isAuthorizationEnabled() && !proxyConfig.isAuthenticationEnabled()) {\n            throw new IllegalStateException(\"Invalid proxy configuration. Authentication must be enabled with \"\n                    + \"authenticationEnabled=true when authorization is enabled with authorizationEnabled=true.\");\n        }\n\n        if (!isBlank(proxyConfig.getMetadataStoreUrl()) && !isBlank(proxyConfig.getConfigurationMetadataStoreUrl())) {\n            localMetadataStore = createLocalMetadataStore();\n            configMetadataStore = createConfigurationMetadataStore();\n            pulsarResources = new PulsarResources(localMetadataStore, configMetadataStore);\n            discoveryProvider = new BrokerDiscoveryProvider(this.proxyConfig, pulsarResources);\n            authorizationService = new AuthorizationService(PulsarConfigurationLoader.convertFrom(proxyConfig),\n                    pulsarResources);\n        }\n\n        ServerBootstrap bootstrap = new ServerBootstrap();\n        bootstrap.option(ChannelOption.SO_REUSEADDR, true);\n        bootstrap.childOption(ChannelOption.ALLOCATOR, PulsarByteBufAllocator.DEFAULT);\n        bootstrap.group(acceptorGroup, workerGroup);\n        bootstrap.childOption(ChannelOption.TCP_NODELAY, true);\n        bootstrap.childOption(ChannelOption.RCVBUF_ALLOCATOR,","sourceCodeStart":251,"sourceCodeEnd":287,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/ProxyService.java#L251-L287","documentation":"ProxyService.start enforces a startup invariant: authorization without authentication is invalid because the proxy would apply ACL checks but have no verified principal/credentials to authorize. It throws IllegalStateException at startup so the operator fixes config rather than running an insecure or nonfunctional proxy.","triggerScenarios":"Calling proxyService.start() when proxyConfig.isAuthorizationEnabled()==true and proxyConfig.isAuthenticationEnabled()==false — i.e. properties contain authorizationEnabled=true but authenticationEnabled is absent or false.","commonSituations":"Operator enables authorization to lock down topics but forgets the prerequisite authentication providers config; security hardening PR turns on authorization in the proxy config file while authentication was only configured on the broker; copy of broker.properties to proxy config missing authenticationEnabled.","solutions":["Set authenticationEnabled=true in the proxy configuration","Configure the required authenticationProvider* list and related provider settings for the chosen auth method","If authorization is not actually needed for the proxy, explicitly set authorizationEnabled=false instead","Restart the proxy after fixing the config and confirm start() completes without the IllegalStateException"],"exampleFix":"// before\nauthenticationEnabled=false\nauthorizationEnabled=true\n\n// after\nauthenticationEnabled=true\nauthenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderToken\nauthorizationEnabled=true","handlingStrategy":"validation","validationCode":"if (proxyConfig.isAuthorizationEnabled() && !proxyConfig.isAuthenticationEnabled()) {\n    throw new IllegalStateException(\n        \"Fix config: set authenticationEnabled=true before authorizationEnabled=true\");\n}\nproxyService.start();","typeGuard":"boolean canStartProxy(ProxyConfiguration cfg) {\n    return !cfg.isAuthorizationEnabled() || cfg.isAuthenticationEnabled();\n}","tryCatchPattern":"try {\n    proxyService.start();\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"Authentication must be enabled\")) {\n        LOG.error(\"Proxy config invalid: enable authentication before authorization\");\n    }\n    throw e;\n}","preventionTips":["Always set authenticationEnabled=true together with authorizationEnabled=true in the proxy config","Document the dependency between authentication and authorization flags in runbooks","Validate proxy config in CI startup tests before deploying","When copying broker config to the proxy, keep both auth flags consistent"],"tags":["pulsar-proxy","configuration","authentication","authorization","startup"],"backgroundTag":"auth-config-invalid","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}