{"record":{"id":"ecf2f0ce3724b38f","repo":"apache/pulsar","slug":"sasljaasserverroletokensignersecretpath-parameter","errorCode":null,"errorMessage":"saslJaasServerRoleTokenSignerSecretPath parameter is empty","messagePattern":"saslJaasServerRoleTokenSignerSecretPath parameter is empty","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java","lineNumber":123,"sourceCode":"        if (jaasCredentialsContainer == null) {\n            log.info().attr(\"value\", loginContextName).log(\"JAAS loginContext is:.\");\n            try {\n                jaasCredentialsContainer = new JAASCredentialsContainer(\n                    loginContextName,\n                    new PulsarSaslServer.SaslServerCallbackHandler(allowedIdsPattern),\n                    configuration);\n            } catch (LoginException e) {\n                log.error().exception(e).log(\"JAAS login in broker failed\");\n                throw new IOException(e);\n            }\n        }\n        String saslJaasServerRoleTokenSignerSecretPath = config.getSaslJaasServerRoleTokenSignerSecretPath();\n        byte[] secret = null;\n        if (StringUtils.isNotBlank(saslJaasServerRoleTokenSignerSecretPath)) {\n            secret = readSecretFromUrl(saslJaasServerRoleTokenSignerSecretPath);\n        } else {\n            String msg = \"saslJaasServerRoleTokenSignerSecretPath parameter is empty\";\n            throw new IllegalArgumentException(msg);\n        }\n        this.signer = new SaslRoleTokenSigner(secret);\n        this.authStates = Caffeine.newBuilder()\n                .recordStats()\n                .maximumSize(config.getMaxInflightSaslContext())\n                .expireAfterWrite(config.getInflightSaslContextExpiryMs(), TimeUnit.MILLISECONDS).build();\n        CacheMetricsCollector.CAFFEINE.addCache(\"auth-sasl-states-cache\", authStates);\n    }\n\n    @Override\n    public String getAuthMethodName() {\n        return SaslConstants.AUTH_METHOD_NAME;\n    }\n\n    @Override\n    public void close() throws IOException {\n        if (jaasCredentialsContainer != null) {\n            jaasCredentialsContainer.close();","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java#L105-L141","documentation":"AuthenticationProviderSasl.initialize found the saslJaasServerRoleTokenSignerSecretPath configuration empty; without a secret file the server cannot sign/verify role tokens, so SASL provider initialization fails.","triggerScenarios":"Thrown at pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java:123 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set saslJaasServerRoleTokenSignerSecretPath in broker.conf to a valid secret file path"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}