{"record":{"id":"e2ad745256bce0aa","repo":"apache/pulsar","slug":"auth-plugin-s-given-but-authparams-is-empty","errorCode":null,"errorMessage":"auth plugin %s given, but authParams is empty","messagePattern":"auth plugin (.+?) given, but authParams is empty","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pulsar-function-go/pf/instance.go","lineNumber":224,"sourceCode":"func (gi *goInstance) setupClient() error {\n\tic := gi.context.instanceConf\n\n\tclientOpts := pulsar.ClientOptions{\n\t\tURL:                        ic.pulsarServiceURL,\n\t\tTLSTrustCertsFilePath:      ic.tlsTrustCertsPath,\n\t\tTLSAllowInsecureConnection: ic.tlsAllowInsecure,\n\t\tTLSValidateHostname:        ic.tlsHostnameVerification,\n\t}\n\n\tswitch ic.authPlugin {\n\tcase authPluginToken:\n\t\tswitch {\n\t\tcase strings.HasPrefix(ic.authParams, \"file://\"):\n\t\t\tclientOpts.Authentication = pulsar.NewAuthenticationTokenFromFile(ic.authParams[7:])\n\t\tcase strings.HasPrefix(ic.authParams, \"token:\"):\n\t\t\tclientOpts.Authentication = pulsar.NewAuthenticationToken(ic.authParams[6:])\n\t\tcase ic.authParams == \"\":\n\t\t\treturn fmt.Errorf(\"auth plugin %s given, but authParams is empty\", authPluginToken)\n\t\tdefault:\n\t\t\treturn fmt.Errorf(`unknown token format - expecting \"file://\" or \"token:\" prefix`)\n\t\t}\n\tcase authPluginNone:\n\t\tclientOpts.Authentication, _ = pulsar.NewAuthentication(\"\", \"\") // ret: auth.NewAuthDisabled()\n\tdefault:\n\t\treturn fmt.Errorf(\"unknown auth provider: %s\", ic.authPlugin)\n\t}\n\n\tclient, err := pulsar.NewClient(clientOpts)\n\tif err != nil {\n\t\tlog.Errorf(\"create client error:%v\", err)\n\t\tgi.stats.incrTotalSysExceptions(err)\n\t\treturn err\n\t}\n\tgi.client = client\n\treturn nil\n}","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-function-go/pf/instance.go#L206-L242","documentation":"When the function instance is configured with the token auth plugin, setupClient inspects ic.authParams. If authParams is empty, no token can be attached to the Pulsar client and setupClient returns this error, aborting instance startup.","triggerScenarios":"Setting AuthenticationPlugin to the token plugin (authPluginToken) in the instance config while leaving AuthenticationParams unset/empty.","commonSituations":"Deploying with auth enabled but forgetting to inject the token via AUTH_PARAMS; k8s secret not mounted so the param resolves to empty; config template placeholder left unfilled.","solutions":["Set AuthenticationParams to \"token:<TOKEN>\" or \"file:///path/to/token\".","If using env-based config, ensure AUTH_PARAMS is exported in the container.","Verify the secret/volume providing the token is mounted and non-empty."],"exampleFix":"// before\n--auth_plugin token --auth_params \"\" // error: authParams is empty\n// after\n--auth_plugin token --auth_params \"token:eyJhbGciOi...\"","handlingStrategy":"validation","validationCode":"if strings.EqualFold(authPlugin, \"token\") && authParams == \"\" {\n    return fmt.Errorf(\"token auth selected but authParams is empty\")\n}","typeGuard":null,"tryCatchPattern":"if err := runInstance(); err != nil {\n    if strings.Contains(err.Error(), \"authParams is empty\") {\n        log.Fatalf(\"provide AUTH_PARAMS with token:<jwt> or file://<path>\")\n    }\n    log.Fatal(err)\n}","preventionTips":["Inject the token via a mounted secret and set AUTH_PARAMS explicitly.","Fail fast in entrypoint scripts when required auth env vars are empty.","Validate function config at deploy time (lint the function manifest)."],"tags":["go","authentication","configuration","token"],"backgroundTag":"missing-auth-credentials","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}