{"record":{"id":"87452758afb4de30","repo":"apache/pulsar","slug":"token-audience-claim-audienceclaim-configured","errorCode":null,"errorMessage":"Token Audience Claim [${audienceClaim}] configured, but Audience stands for this broker not.","messagePattern":"Token Audience Claim \\[(.+?)\\] configured, but Audience stands for this broker not\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java","lineNumber":148,"sourceCode":"        this.confTokenAudienceSettingName = prefix + CONF_TOKEN_AUDIENCE;\n        this.confTokenAllowedClockSkewSecondsSettingName = prefix + CONF_TOKEN_ALLOWED_CLOCK_SKEW_SECONDS;\n\n        // we need to fetch the algorithm before we fetch the key\n        this.publicKeyAlg = getPublicKeyAlgType(config);\n        this.validationKey = getValidationKey(config);\n        this.roleClaim = getTokenRoleClaim(config);\n        this.audienceClaim = getTokenAudienceClaim(config);\n        this.audience = getTokenAudience(config);\n\n        long allowedSkew = getConfTokenAllowedClockSkewSeconds(config);\n\n        this.parser = Jwts.parser()\n                .setAllowedClockSkewSeconds(allowedSkew)\n                .setSigningKey(this.validationKey)\n                .build();\n\n        if (audienceClaim != null && audience == null) {\n            throw new IllegalArgumentException(\"Token Audience Claim [\" + audienceClaim\n                    + \"] configured, but Audience stands for this broker not.\");\n        }\n    }\n\n    @Override\n    public String getAuthMethodName() {\n        return TOKEN;\n    }\n\n    @Override\n    public void incrementFailureMetric(Enum<?> errorCode) {\n        authenticationMetricsToken.recordFailure(errorCode);\n    }\n\n    @Override\n    public String authenticate(AuthenticationDataSource authData) throws AuthenticationException {\n        String token;\n        try {","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java#L130-L166","documentation":"This is a configuration error thrown from AuthenticationProviderToken.initialize(). It is an IllegalArgumentException raised at broker startup when the broker configures an audienceClaim (the claim name in the token that carries the intended audience) but does not configure audience (the value identifying this broker). Without the expected audience value, the claim cannot be validated.","triggerScenarios":"Setting tokenAudienceClaim (e.g. 'aud') in broker.conf while leaving tokenAudience unset, then initializing AuthenticationProviderToken.","commonSituations":"Copy-pasting only part of the token-audience config from documentation; enabling audience validation for multi-tenant token issuance but forgetting to set the broker's own audience identifier.","solutions":["Set tokenAudience in the broker configuration to the audience value tokens must contain (e.g. tokenAudience=pulsar)","Remove tokenAudienceClaim if you do not intend audience validation at all","Restart the broker after fixing the configuration"],"exampleFix":"# broker.conf before\ntokenAudienceClaim=aud\n# tokenAudience missing\n// after\ntokenAudienceClaim=aud\ntokenAudience=pulsar","handlingStrategy":"validation","validationCode":"Properties props = loadBrokerConf();\nif (props.containsKey(\"tokenAudienceClaim\") && !props.containsKey(\"tokenAudience\")) {\n    throw new IllegalArgumentException(\"tokenAudienceClaim set but tokenAudience missing\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    provider.initialize(config); // or startup path\n} catch (IllegalArgumentException e) {\n    log.fatal(\"Token audience configuration incomplete: {}\", e.getMessage());\n    throw e; // fail fast at startup\n}","preventionTips":["Always set tokenAudienceClaim and tokenAudience as a pair","Validate broker.conf in CI before rolling out","Keep a documented example of the token-audience config in your deployment repo"],"tags":["configuration","jwt","token"],"backgroundTag":"missing-config-property","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}