{"record":{"id":"ea14b5c8745cdf41","repo":"apache/pulsar","slug":"missing-configured-value-for","errorCode":null,"errorMessage":"Missing configured value for: ","messagePattern":"Missing configured value for: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"critical","filePath":"pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/AuthenticationProviderOpenID.java","lineNumber":494,"sourceCode":"            throw new AuthenticationException(\"JWT verification failed: \" + e.getMessage());\n        }\n    }\n\n    /**\n     * Validate the configured allow list of allowedIssuers. The allowedIssuers set must be nonempty in order for\n     * the plugin to authenticate any token. Thus, it fails initialization if the configuration is\n     * missing. Each issuer URL should use the HTTPS scheme. The plugin fails initialization if any\n     * issuer url is insecure, unless requireHttps is false.\n     * @param allowedIssuers - issuers to validate\n     * @param requireHttps - whether to require https for issuers.\n     * @param allowEmptyIssuers - whether to allow empty issuers. This setting only makes sense when kubernetes is used\n     *                   as a fallback issuer.\n     * @return the validated issuers\n     * @throws IllegalArgumentException if the allowedIssuers is empty, or contains insecure issuers when required\n     */\n    private Set<String> validateIssuers(Set<String> allowedIssuers, boolean requireHttps, boolean allowEmptyIssuers) {\n        if (allowedIssuers == null || (allowedIssuers.isEmpty() && !allowEmptyIssuers)) {\n            throw new IllegalArgumentException(\"Missing configured value for: \" + ALLOWED_TOKEN_ISSUERS);\n        }\n        for (String issuer : allowedIssuers) {\n            if (!issuer.toLowerCase().startsWith(\"https://\")) {\n                log.warn().attr(\"issuer\", issuer).log(\"Allowed issuer is not using https scheme\");\n                if (requireHttps) {\n                    throw new IllegalArgumentException(\"Issuer URL does not use https, but must: \" + issuer);\n                }\n            }\n        }\n        return allowedIssuers;\n    }\n\n    /**\n     * Validate the configured allow list of allowedAudiences. The allowedAudiences must be set because\n     * JWT must have an audience claim.\n     * See https://openid.net/specs/openid-connect-basic-1_0.html#IDTokenValidation.\n     * @param allowedAudiences\n     * @return the validated audiences","sourceCodeStart":476,"sourceCodeEnd":512,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/AuthenticationProviderOpenID.java#L476-L512","documentation":"An IllegalArgumentException thrown by validateIssuers during initialize when the allowedTokenIssuers configuration property is null or empty (and empty issuers are not permitted). Initialization of the OpenID authentication provider fails immediately because without at least one issuer the plugin can authenticate no tokens.","triggerScenarios":"Broker starts with the OpenID auth provider enabled but the authenticationProviderOpenID.allowedTokenIssuers property absent, set to an empty string, or resolving to an empty set; also raised when allowEmptyIssuers is false (kubernetes fallback not enabled) and the set is empty.","commonSituations":"Fresh broker.conf where OIDC properties were never added; a typo in the property name so the value is silently missing; configuration templating that rendered an empty value; operators disabling an IdP by clearing its issuer from the list entirely.","solutions":["Set authenticationProviderOpenID.allowedTokenIssuers in broker.conf to a comma-separated list of HTTPS issuer URLs","Fix any templating/typo issues so the property is actually present and non-empty","If running against Kubernetes service-account tokens intentionally, enable the kubernetes fallback so empty issuers are permitted","Restart/reload the broker after correcting the configuration"],"exampleFix":"// before (broker.conf)\n# authenticationProviderOpenID.allowedTokenIssuers= (missing)\n// after\nauthenticationProviderOpenID.allowedTokenIssuers=https://accounts.google.com,https://login.microsoftonline.com/<tenant>/v2.0","handlingStrategy":"validation","validationCode":"// Before starting the broker, check the property resolves to a non-empty issuer set\nSet<String> issuers = parseCsv(config.getString(\"authenticationProviderOpenID.allowedTokenIssuers\"));\nif (issuers == null || issuers.isEmpty()) {\n    throw new IllegalStateException(\"authenticationProviderOpenID.allowedTokenIssuers must be set\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    provider.initialize(config);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"allowedTokenIssuers\")) {\n        throw new IllegalStateException(\"OIDC provider requires a non-empty allowedTokenIssuers setting\", e);\n    }\n    throw e;\n}","preventionTips":["Always set authenticationProviderOpenID.allowedTokenIssuers when enabling the OIDC auth provider","Use config linting/validation on broker.conf before deployment","Beware typos in property names — missing keys fail here rather than at parse time","If relying on the Kubernetes fallback, enable it explicitly so empty issuers are intentional, not accidental"],"tags":["configuration","oidc","startup-failure","missing-config"],"backgroundTag":"missing-config-property","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}