{"record":{"id":"932df85bfb9ec06d","repo":"apache/pulsar","slug":"keystream-provider-or-stream-must-not-be-null","errorCode":null,"errorMessage":"keyStream provider or stream must not be null","messagePattern":"keyStream provider or stream must not be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationDataTls.java","lineNumber":76,"sourceCode":"        this.certFile = new FileModifiedTimeUpdater(certFilePath);\n        this.keyFile = new FileModifiedTimeUpdater(keyFilePath);\n        this.tlsCertificates = PemReader.loadCertificatesFromPemFile(certFilePath);\n        this.tlsPrivateKey = PemReader.loadPrivateKeyFromPemFile(keyFilePath);\n    }\n\n    public AuthenticationDataTls(Supplier<ByteArrayInputStream> certStreamProvider,\n            Supplier<ByteArrayInputStream> keyStreamProvider) throws KeyManagementException {\n        this(certStreamProvider, keyStreamProvider, null);\n    }\n\n    public AuthenticationDataTls(Supplier<ByteArrayInputStream> certStreamProvider,\n            Supplier<ByteArrayInputStream> keyStreamProvider, Supplier<ByteArrayInputStream> trustStoreStreamProvider)\n            throws KeyManagementException {\n        if (certStreamProvider == null || certStreamProvider.get() == null) {\n            throw new IllegalArgumentException(\"certStream provider or stream must not be null\");\n        }\n        if (keyStreamProvider == null || keyStreamProvider.get() == null) {\n            throw new IllegalArgumentException(\"keyStream provider or stream must not be null\");\n        }\n        this.certStreamProvider = certStreamProvider;\n        this.keyStreamProvider = keyStreamProvider;\n        this.trustStoreStreamProvider = trustStoreStreamProvider;\n        this.certStream = certStreamProvider.get();\n        this.keyStream = keyStreamProvider.get();\n        this.tlsCertificates = PemReader.loadCertificatesFromPemStream(certStream);\n        this.tlsPrivateKey = PemReader.loadPrivateKeyFromPemStream(keyStream);\n    }\n    /*\n     * TLS\n     */\n\n    @Override\n    public boolean hasDataForTls() {\n        return true;\n    }\n","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationDataTls.java#L58-L94","documentation":"The stream-based AuthenticationDataTls constructor throws IllegalArgumentException when keyStreamProvider is null or its Supplier<ByteArrayInputStream>.get() returns null. Like the cert check, mTLS requires the client private key; a provider yielding no stream cannot build TLS auth data.","triggerScenarios":"Calling the three-supplier AuthenticationDataTls constructor where keyStreamProvider is null or returns null (e.g. key resource missing on the classpath, lazily-loaded key not yet provisioned).","commonSituations":"Private key resource excluded from the packaged artifact; secret manager returning null when the key hasn't been rotated into place; copy-pasting the cert supplier wiring but forgetting the key supplier; optional suppliers left empty.","solutions":["Ensure keyStreamProvider is non-null and returns a valid ByteArrayInputStream with the PEM private key.","Verify the key resource/secret exists and the supplier does not cache a null result.","Assert both cert and key streams resolve before constructing AuthenticationDataTls."],"exampleFix":"// before\nnew AuthenticationDataTls(cert, null, trust); // key provider missing\n// after\nObjects.requireNonNull(key, \"keyStreamProvider must be provided\");\nnew AuthenticationDataTls(cert, key, trust);","handlingStrategy":"validation","validationCode":"ByteArrayInputStream key = keyStreamProvider != null ? keyStreamProvider.get() : null;\nif (key == null || key.available() == 0) {\n    throw new IllegalStateException(\"key stream provider must yield a non-empty PEM stream\");\n}","typeGuard":"boolean hasStream(Supplier<ByteArrayInputStream> s) { return s != null && s.get() != null; }","tryCatchPattern":"try {\n    authData = new AuthenticationDataTls(certStreamProvider, keyStreamProvider, trustStoreStreamProvider);\n} catch (IllegalArgumentException | KeyManagementException e) {\n    log.error(\"TLS stream auth misconfigured: {}\", e.getMessage());\n    throw e;\n}","preventionTips":["Wire both cert and key suppliers together; never pass null for one of them.","Verify private key resources are packaged/available in the deployment artifact.","Handle secret rotation so the key stream source never resolves to null at runtime."],"tags":["java","tls","authentication","streams","pulsar-client"],"backgroundTag":"missing-tls-certificate","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}