{"record":{"id":"f70b5cbf33cd08b7","repo":"apache/pulsar","slug":"error-caching-authentication-data-for-s-s-s-f70b5c","errorCode":null,"errorMessage":"Error caching authentication data for %s %s:- %s","messagePattern":"Error caching authentication data for (.+?) (.+?):- (.+?)","errorType":"http","errorClass":"RestException","httpStatus":500,"severity":"error","filePath":"pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/SourcesImpl.java","lineNumber":226,"sourceCode":"                        try {\n                            Optional<FunctionAuthData> functionAuthData = functionAuthProvider\n                                    .cacheAuthData(finalFunctionDetails,\n                                            authParams.getClientAuthenticationDataSource());\n\n                            functionAuthData.ifPresent(authData ->\n                                    functionMetaDataObj.setFunctionAuthSpec()\n                                            .setData(authData.getData()));\n                        } catch (Exception e) {\n                            log.error().attr(\"componentType\", ComponentTypeUtils.toString(componentType))\n\n                                    .attr(\"tenant\", tenant).attr(\"namespace\", namespace)\n\n                                    .attr(\"componentName\", sourceName).exception(e)\n\n                                    .log(\"Error caching authentication data for / /\");\n\n\n                            throw new RestException(Response.Status.INTERNAL_SERVER_ERROR,\n                                    String.format(\"Error caching authentication data for %s %s:- %s\",\n                                            ComponentTypeUtils.toString(componentType), sourceName, e.getMessage()));\n                        }\n                    }\n                });\n            }\n\n            PackageLocationMetaData packageLocationMetaData;\n            try {\n                packageLocationMetaData = getFunctionPackageLocation(functionMetaDataObj,\n                        sourcePkgUrl, fileDetail, componentPackageFile);\n            } catch (Exception e) {\n                log.error().attr(\"componentType\", ComponentTypeUtils.toString(componentType)).attr(\"tenant\", tenant)\n\n                        .attr(\"namespace\", namespace).attr(\"componentName\", sourceName).exception(e)\n\n                        .log(\"Failed process / / package\");\n                throw new RestException(Response.Status.INTERNAL_SERVER_ERROR, e.getMessage());","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/SourcesImpl.java#L208-L244","documentation":"When worker authentication is enabled and the runtime factory provides a FunctionAuthProvider, registerSource tries to cache the client's authentication data for the source. If cacheAuthData throws, the worker returns 500 INTERNAL_SERVER_ERROR with 'Error caching authentication data for <ComponentType> <sourceName>:- <reason>'. This is a server-side failure while preparing per-function credentials for the runtime, not a problem with the source config itself.","triggerScenarios":"registerSource with worker authenticationEnabled=true and a runtime factory auth provider whose cacheAuthData(clientAuthenticationDataSource) throws — e.g. serialization failure of auth data, backend store unavailable, or a misconfigured auth provider.","commonSituations":"Client passing an authentication data source the provider cannot serialize; Kubernetes runtime factory auth plugin failing to write secrets; auth plugin version mismatch between worker config and expected interface; auth backend (e.g. a state store) down.","solutions":["Check the worker log entry 'Error caching authentication data for / /' for the full underlying stack trace.","Verify the client authentication plugin configured for the CLI/API call is valid and its data source can be serialized by the runtime auth provider.","Review the FunctionAuthProvider implementation configured in the worker (getAuthProvider) for bugs or incompatible versions.","If auth data caching is unnecessary for the deployment, either disable worker authentication or use a runtime factory without a function auth provider."],"exampleFix":"// before: worker conf pointing at an incompatible/absent auth provider\nfunctionAuthProviderClassName: com.example.BrokenFunctionAuthProvider\n\n// after: use the shipped provider for the configured runtime\nfunctionAuthProviderClassName: org.apache.pulsar.functions.auth.KubernetesFunctionAuthProvider","handlingStrategy":"try-catch","validationCode":"// Before registering, confirm the client auth data source is usable\nif (authParams != null && authParams.getClientAuthenticationDataSource() != null) {\n    Objects.requireNonNull(authParams.getClientAuthenticationDataSource(), \"auth data source must not be null\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    admin.sources().createSource(cfg, pkgUrl, archive);\n} catch (PulsarAdminException e) {\n    if (e.getStatusCode() == 500 && e.getMessage() != null && e.getMessage().startsWith(\"Error caching authentication data\")) {\n        // inspect worker logs; fix client auth plugin or worker auth provider, then retry\n    } else {\n        throw e;\n    }\n}","preventionTips":["Use the officially shipped FunctionAuthProvider matching your runtime factory (Kubernetes/Process/Thread).","Keep client and server auth plugin versions aligned.","Confirm the worker's authenticationEnabled setting matches your intended deployment; don't enable it without a working auth provider."],"tags":["rest-api","internal-server-error","authentication","pulsar-functions"],"backgroundTag":"auth-data-cache-failure","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}