{"record":{"id":"e49b558d9fc02aeb","repo":"apache/pulsar","slug":"invalid-allowed-offset-for-athenz-role-token-verif","errorCode":null,"errorMessage":"Invalid allowed offset for athenz role token verification specified","messagePattern":"Invalid allowed offset for athenz role token verification specified","errorType":"console","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java","lineNumber":84,"sourceCode":"                getClass().getSimpleName(), getAuthMethodName());\n        var config = context.getConfig();\n        String domainNames;\n        if (config.getProperty(DOMAIN_NAME_LIST) != null) {\n            domainNames = (String) config.getProperty(DOMAIN_NAME_LIST);\n        } else if (!StringUtils.isEmpty(System.getProperty(SYS_PROP_DOMAIN_NAME_LIST))) {\n            domainNames = System.getProperty(SYS_PROP_DOMAIN_NAME_LIST);\n        } else {\n            throw new IOException(\"No athenz domain name specified\");\n        }\n\n        domainNameList = Lists.newArrayList(domainNames.split(\",\"));\n        log.info().attr(\"domainNames\", domainNameList).log(\"Supported domain names for Athenz\");\n\n        if (!StringUtils.isEmpty(System.getProperty(SYS_PROP_ALLOWED_OFFSET))) {\n            try {\n                allowedOffset = Integer.parseInt(System.getProperty(SYS_PROP_ALLOWED_OFFSET));\n            } catch (NumberFormatException e) {\n                throw new IOException(\"Invalid allowed offset for athenz role token verification specified\", e);\n            }\n\n            if (allowedOffset < 0) {\n                throw new IOException(\"Allowed offset for athenz role token verification must not be negative\");\n            }\n        }\n\n        log.info().attr(\"allowedOffsetSeconds\", allowedOffset).log(\"Allowed offset for athenz role token verification\");\n    }\n\n    @Override\n    public String getAuthMethodName() {\n        return \"athenz\";\n    }\n\n    @Override\n    public void incrementFailureMetric(Enum<?> errorCode) {\n        authenticationMetrics.recordFailure(errorCode);","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java#L66-L102","documentation":"After reading domain names, initialize() optionally parses the allowed clock offset for Athenz role token verification from a system property. If the value is not a valid integer, Integer.parseInt throws NumberFormatException which is wrapped into this IOException. The offset is used to tolerate clock skew when validating token timestamps.","triggerScenarios":"System property SYS_PROP_ALLOWED_OFFSET is set (non-empty) but its value is non-numeric, e.g. '30s', 'thirty', or contains whitespace/units.","commonSituations":"Operator wrote '-Dathenz.allowed.offset=30 seconds' or '30s' instead of plain integer seconds; quoting issues in systemd/docker env passing stray characters.","solutions":["Set the system property to a plain integer number of seconds, e.g. -D<allowedOffsetSysProp>=30.","Remove the system property entirely to use the default offset.","Check for stray quotes, units, or whitespace in launcher scripts, docker env files, or k8s manifests."],"exampleFix":"// before\nPULSAR_GC_OPTS=\"-Dathenz.allowed.offset=30s\"\n// after\nPULSAR_GC_OPTS=\"-Dathenz.allowed.offset=30\"","handlingStrategy":"validation","validationCode":"String off = System.getProperty(ATHENZ_SYS_PROP_ALLOWED_OFFSET);\nif (off != null && !off.isEmpty()) {\n    try { Integer.parseInt(off.trim()); }\n    catch (NumberFormatException e) { throw new IllegalArgumentException(\"allowed offset must be plain integer seconds: \" + off); }\n}","typeGuard":null,"tryCatchPattern":"try {\n    provider.initialize(config);\n} catch (IOException e) {\n    if (e.getMessage().contains(\"Invalid allowed offset\")) {\n        log.error(\"Fix the offset system property to a plain integer of seconds\");\n    }\n    throw e;\n}","preventionTips":["Always specify the offset as bare integer seconds (no units, quotes, whitespace).","Review JVM opts in launcher scripts/env files after edits.","Omit the property if you want the default behavior."],"tags":["athenz","authentication","configuration","number-format"],"backgroundTag":"invalid-number-format","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}