{"record":{"id":"fcff2dead72dba2b","repo":"apache/pulsar","slug":"invalid-algorithm-provided-tokenpublicalg","errorCode":null,"errorMessage":"invalid algorithm provided ${tokenPublicAlg}","messagePattern":"invalid algorithm provided (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"critical","filePath":"pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java","lineNumber":319,"sourceCode":"        }\n    }\n\n    private String getTokenRoleClaim(ServiceConfiguration conf) throws IOException {\n        String tokenAuthClaim = (String) conf.getProperty(confTokenAuthClaimSettingName);\n        if (StringUtils.isNotBlank(tokenAuthClaim)) {\n            return tokenAuthClaim;\n        } else {\n            return Claims.SUBJECT;\n        }\n    }\n\n    private SignatureAlgorithm getPublicKeyAlgType(ServiceConfiguration conf) throws IllegalArgumentException {\n        String tokenPublicAlg = (String) conf.getProperty(confTokenPublicAlgSettingName);\n        if (StringUtils.isNotBlank(tokenPublicAlg)) {\n            try {\n                return SignatureAlgorithm.forName(tokenPublicAlg);\n            } catch (SignatureException ex) {\n                throw new IllegalArgumentException(\"invalid algorithm provided \" + tokenPublicAlg, ex);\n            }\n        } else {\n            return SignatureAlgorithm.RS256;\n        }\n    }\n\n    // get Token Audience Claim from configuration, if not configured return null.\n    private String getTokenAudienceClaim(ServiceConfiguration conf) throws IllegalArgumentException {\n        String tokenAudienceClaim = (String) conf.getProperty(confTokenAudienceClaimSettingName);\n        if (StringUtils.isNotBlank(tokenAudienceClaim)) {\n            return tokenAudienceClaim;\n        } else {\n            return null;\n        }\n    }\n\n    // get Token Audience that stands for this broker from configuration, if not configured return null.\n    private String getTokenAudience(ServiceConfiguration conf) throws IllegalArgumentException {","sourceCodeStart":301,"sourceCodeEnd":337,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java#L301-L337","documentation":"getPublicKeyAlgType reads tokenPublicAlg from the configuration and converts it to a jjwt SignatureAlgorithm. If SignatureAlgorithm.forName doesn't recognize the value it throws a SignatureException, which is rethrown as an IllegalArgumentException naming the invalid algorithm. Only used for the asymmetric (tokenPublicKey) path.","triggerScenarios":"initialize configures the provider with a tokenPublicAlg value that is not a valid jjwt SignatureAlgorithm name (e.g. 'RS512 ' with whitespace, 'ES512-K', 'rs256' if the jjwt version requires exact case, or a completely unknown name).","commonSituations":"Typo in the algorithm name in broker.conf; using an algorithm name from another library's naming scheme; setting tokenPublicAlg while using a symmetric tokenSecretKey where it doesn't apply; whitespace or quoting artifacts around the value.","solutions":["Set tokenPublicAlg to a valid jjwt SignatureAlgorithm name: RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.","Remove tokenPublicAlg entirely to accept the RS256 default.","Check for stray whitespace/quotes around the value in the conf file.","Match the algorithm to the one actually used when the key pair was generated and tokens were signed (e.g. bin/pulsar tokens create-key-pair --output-algorithm ES256)."],"exampleFix":"// before (broker.conf)\ntokenPublicAlg=rs512\n// after\ntokenPublicAlg=RS512","handlingStrategy":"validation","validationCode":"// Validate the configured algorithm against jjwt's registry before startup:\ntry {\n    io.jsonwebtoken.SignatureAlgorithm.forName(conf.getProperty(\"tokenPublicAlg\").toString().trim());\n} catch (io.jsonwebtoken.SignatureException e) {\n    throw new IllegalStateException(\"tokenPublicAlg must be one of RS256,RS384,RS512,ES256,ES384,ES512,PS256,PS384,PS512\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    authenticationProvider.initialize(conf);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"invalid algorithm provided\")) {\n        throw new IllegalStateException(\"Fix tokenPublicAlg in broker.conf; use an exact jjwt SignatureAlgorithm name\", e);\n    }\n    throw e;\n}","preventionTips":["Use the exact uppercase jjwt algorithm names (RS256, ES256, ...) in configuration.","Match tokenPublicAlg to the --output-algorithm used when generating the key pair.","Strip whitespace/quotes from conf values when templating.","Only set tokenPublicAlg when using tokenPublicKey (asymmetric); it is irrelevant for symmetric tokenSecretKey setups."],"tags":["configuration","authentication","algorithm","startup"],"backgroundTag":"invalid-algorithm-config","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}