{"record":{"id":"f83280e78f3b5e58","repo":"apache/pulsar","slug":"failed-to-parse-authparams","errorCode":null,"errorMessage":"Failed to parse authParams","messagePattern":"Failed to parse authParams","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client-auth-athenz/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationAthenz.java","lineNumber":204,"sourceCode":"        @Override\n        public String roleToken() {\n            return shim.currentRoleToken();\n        }\n\n        @Override\n        public String roleHeaderName() {\n            return shim.currentRoleHeaderName();\n        }\n    }\n\n    @Override\n    public void configure(String encodedAuthParamString) {\n        checkArgument(isNotBlank(encodedAuthParamString), \"authParams must not be empty\");\n\n        try {\n            setAuthParams(AuthenticationUtil.configureFromJsonString(encodedAuthParamString));\n        } catch (IOException e) {\n            throw new IllegalArgumentException(\"Failed to parse authParams\", e);\n        }\n    }\n\n    @Override\n    @Deprecated\n    public void configure(Map<String, String> authParams) {\n        setAuthParams(authParams);\n    }\n\n    private void setAuthParams(Map<String, String> authParams) {\n        this.tenantDomain = authParams.get(\"tenantDomain\");\n        this.tenantService = authParams.get(\"tenantService\");\n        this.providerDomain = authParams.get(\"providerDomain\");\n        this.keyId = authParams.getOrDefault(\"keyId\", \"0\");\n        this.autoPrefetchEnabled = Boolean.parseBoolean(authParams.getOrDefault(\"autoPrefetchEnabled\", \"false\"));\n\n        if (isNotBlank(authParams.get(\"x509CertChain\"))) {\n            // When using Copper Argos","sourceCodeStart":186,"sourceCodeEnd":222,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client-auth-athenz/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationAthenz.java#L186-L222","documentation":"AuthenticationAthenz.configure(String) parses the authParams string as JSON via AuthenticationUtil.configureFromJsonString. If the string is blank-checked ok but is not valid JSON (IOException during parsing), it is rethrown as IllegalArgumentException with message 'Failed to parse authParams' and the IOException as cause.","triggerScenarios":"Calling authentication.configure(...) with a string that is non-blank but not valid JSON, e.g. properties-style 'tenant=mytenant' instead of '{\"tenant\":\"mytenant\",...}'.","commonSituations":"Pulsar client conf where authParams contains JSON with smart quotes, trailing commas, or unescaped characters; users pasting the properties-style param format expected by other auth plugins (e.g. basic/token auth).","solutions":["Wrap the params in valid JSON: '{\"tenant\":\"...\",\"service\":\"...\",\"privateKey\":\"data:...\"}'","Validate the JSON with a parser (e.g. jq or a quick ObjectMapper readTree) before passing it to configure()","Check the cause (IOException / Jackson message) in the stack trace for the exact parse offset"],"exampleFix":"// before\nauth.configure(\"tenant=mytenant;service=svc\");\n// after\nauth.configure(\"{\\\"tenant\\\":\\\"mytenant\\\",\\\"service\\\":\\\"svc\\\"}\");","handlingStrategy":"validation","validationCode":"new ObjectMapper().readTree(authParamsString); // throws if not valid JSON — run before configure()\nif (authParamsString == null || authParamsString.isBlank()) throw new IllegalArgumentException(\"authParams must not be empty\");","typeGuard":"boolean isJson(String s) {\n    try { new ObjectMapper().readTree(s); return true; } catch (Exception e) { return false; }\n}","tryCatchPattern":"try {\n    authentication.configure(authParamsJson);\n} catch (IllegalArgumentException e) {\n    log.error(\"authParams is not valid JSON: {}\", e.getCause() != null ? e.getCause().getMessage() : e.getMessage());\n    throw new ConfigException(\"Fix the JSON in authParams for the Athenz auth plugin\", e);\n}","preventionTips":["Keep authParams as valid JSON, not key=value pairs","Lint the JSON with jq or a parser before deploying","Read the cause chain — Jackson names the exact parse error"],"tags":["java","json","athenz","auth-config"],"backgroundTag":"invalid-json-config","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}