{"record":{"id":"fd3f2c7768068d7e","repo":"apache/pulsar","slug":"passed-in-parameter-empty-keystore-path-keysto","errorCode":null,"errorMessage":"Passed in parameter empty. KEYSTORE_PATH: ${keyStorePath} KEYSTORE_PW: ${keyStorePassword}","messagePattern":"Passed in parameter empty\\. KEYSTORE_PATH: (.+?) KEYSTORE_PW: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationKeyStoreTls.java","lineNumber":123,"sourceCode":"\n        // in \":\" \",\" format.\n        params = (params == null || params.isEmpty())\n                ? AuthenticationUtil.configureFromPulsar1AuthParamString(paramsString)\n                : params;\n\n        configure(params);\n    }\n\n    @SuppressWarnings(\"deprecation\")\n    @Override\n    public void configure(Map<String, String> params) {\n        String keyStoreType = params.get(KEYSTORE_TYPE);\n        String keyStorePath = params.get(KEYSTORE_PATH);\n        String keyStorePassword = params.get(KEYSTORE_PW);\n\n        if (Strings.isNullOrEmpty(keyStorePath)\n            || Strings.isNullOrEmpty(keyStorePassword)) {\n            throw new IllegalArgumentException(\"Passed in parameter empty. \"\n                                               + KEYSTORE_PATH + \": \" + keyStorePath\n                                               + \" \" + KEYSTORE_PW + \": \" + keyStorePassword);\n        }\n\n        if (Strings.isNullOrEmpty(keyStoreType)) {\n            keyStoreType = DEFAULT_KEYSTORE_TYPE;\n        }\n\n        this.keyStoreParams = KeyStoreParams.builder()\n                .keyStoreType(keyStoreType)\n                .keyStorePath(keyStorePath)\n                .keyStorePassword(keyStorePassword)\n                .build();\n    }\n\n    @Override\n    public void start() throws PulsarClientException {\n        // noop","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationKeyStoreTls.java#L105-L141","documentation":"AuthenticationKeyStoreTls.configure(Map) throws IllegalArgumentException when keyStorePath or keyStorePassword is null/empty (checked with Guava Strings.isNullOrEmpty). Keystore-based TLS auth requires both the keystore file location and its password to load keys/trust material, so missing or blank values abort configuration. Note the message template prints the values, which may themselves contain sensitive password text.","triggerScenarios":"Configuring auth with AuthenticationKeyStoreTls where authParams lacks 'keyStorePath' or 'keyStorePassword', or supplies them as empty strings; also hit when environment expansion in the params string resolves to empty.","commonSituations":"authParams JSON only setting keyStoreType; keystores with genuinely empty passwords (unsupported here); config templating leaving ${KEYSTORE_PATH} unexpanded so it resolves oddly; migrating from PEM TLS auth to keystore auth without porting all params.","solutions":["Set both 'keyStorePath' and 'keyStorePassword' in the authParams map passed to the plugin.","Verify environment/config templating actually expands the path and password values.","If the keystore has no password, provide an explicit non-empty password string as required by the keystore configuration.","Validate the params map at startup (assert both keys present and non-blank) before constructing the client."],"exampleFix":"// before\nparams: {\"keyStoreType\": \"JKS\", \"keyStorePath\": \"/certs/client.keystore.jks\"} // keyStorePassword missing\n// after\nparams: {\"keyStoreType\": \"JKS\", \"keyStorePath\": \"/certs/client.keystore.jks\", \"keyStorePassword\": \"clientpw\"}","handlingStrategy":"validation","validationCode":"if (Strings.isNullOrEmpty(params.get(\"keyStorePath\")) || Strings.isNullOrEmpty(params.get(\"keyStorePassword\"))) {\n    throw new IllegalArgumentException(\"keyStorePath and keyStorePassword are required for keystore TLS auth\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    auth = new AuthenticationKeyStoreTls();\n    auth.configure(params);\n} catch (IllegalArgumentException e) {\n    log.error(\"keystore TLS auth params invalid: {}\", e.getMessage());\n    throw e;\n}","preventionTips":["Always include keyStorePath and keyStorePassword in the authParams map.","Validate config templating/expansion so placeholders resolve to real values.","If the keystore uses no password, still supply an explicit non-empty password value.","Smoke-test keystore loading (KeyStore.load) in startup checks before connecting."],"tags":["java","tls","keystore","authentication","configuration","pulsar-client"],"backgroundTag":"missing-config-property","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}