{"record":{"id":"8610179cebe2ad54","repo":"apache/pulsar","slug":"unsupported-auth-method-tokenendpointauthmethod","errorCode":null,"errorMessage":"Unsupported auth method: ${tokenEndpointAuthMethod}","messagePattern":"Unsupported auth method: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/AuthenticationFactoryOAuth2.java","lineNumber":340,"sourceCode":"            } else if (tokenEndpointAuthMethod == TokenEndpointAuthMethod.TLS_CLIENT_AUTH) {\n                if (StringUtils.isBlank(tlsCertFile) || StringUtils.isBlank(tlsKeyFile)) {\n                    throw new IllegalArgumentException(\"Required configuration parameters: tlsCertFile, tlsKeyFile\");\n                }\n                flow = TlsClientAuthFlow.builder()\n                        .issuerUrl(issuerUrl)\n                        .clientId(clientId)\n                        .certFile(tlsCertFile)\n                        .keyFile(tlsKeyFile)\n                        .audience(audience)\n                        .scope(scope)\n                        .connectTimeout(connectTimeout)\n                        .readTimeout(readTimeout)\n                        .trustCertsFilePath(trustCertsFilePath)\n                        .wellKnownMetadataPath(wellKnownMetadataPath)\n                        .autoCertRefreshDuration(autoCertRefreshDuration)\n                        .build();\n            } else {\n                throw new IllegalArgumentException(\"Unsupported auth method: \" + tokenEndpointAuthMethod);\n            }\n            return new AuthenticationOAuth2(flow, earlyTokenRefreshPercent, scheduler);\n        }\n\n    }\n\n\n}\n","sourceCodeStart":322,"sourceCodeEnd":349,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/AuthenticationFactoryOAuth2.java#L322-L349","documentation":"AuthenticationFactoryOAuth2.build() dispatches on the configured TokenEndpointAuthMethod (CLIENT_SECRET_POST, CLIENT_SECRET_BASIC via the standard flow, or TLS_CLIENT_AUTH). Any other/unrecognized value reaches the final else branch and throws this IllegalArgumentException. Note the message template uses the raw method value, so the thrown text reads 'Unsupported auth method: <value>'.","triggerScenarios":"Passing an unknown TokenEndpointAuthMethod enum value (e.g. from parsing an arbitrary string) or null combined with no recognized default branch to build().","commonSituations":"Typo in a config file that maps strings to TokenEndpointAuthMethod (e.g. 'tls-auth' vs 'tls_client_auth'); running an older client version that lacks a newly introduced auth method; custom enum deserialization producing an unexpected value.","solutions":["Set tokenEndpointAuthMethod to a supported value: client_secret_basic, client_secret_post, or tls_client_auth.","Fix string-to-enum mapping/typos in the configuration source.","Upgrade pulsar-client if the desired auth method is newer than your client version."],"exampleFix":"// before\n.tokenEndpointAuthMethod(TokenEndpointAuthMethod.valueOf(\"client_secret\")) // no such enum -> throws\n// after\n.tokenEndpointAuthMethod(TokenEndpointAuthMethod.CLIENT_SECRET_POST)","handlingStrategy":"validation","validationCode":"Set<TokenEndpointAuthMethod> supported = Set.of(\n    TokenEndpointAuthMethod.CLIENT_SECRET_BASIC,\n    TokenEndpointAuthMethod.CLIENT_SECRET_POST,\n    TokenEndpointAuthMethod.TLS_CLIENT_AUTH);\nif (!supported.contains(method)) {\n    throw new IllegalStateException(\"Auth method not supported by this client version: \" + method);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return builder.build();\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Unsupported auth method\")) {\n        throw new ConfigurationException(\"Use client_secret_basic/post or tls_client_auth\", e);\n    }\n    throw e;\n}","preventionTips":["Map config strings to enum values with a whitelist, not valueOf on raw input.","Keep client version and config docs in sync — new auth methods require newer clients.","Log the unsupported method value in your wrapper for easier diagnosis."],"tags":["pulsar-client","oauth2","configuration","unsupported-value"],"backgroundTag":"unsupported-auth-method","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}