{"record":{"id":"fe176208579040ee","repo":"apache/pulsar","slug":"unsupported-token-endpoint-auth-method-value","errorCode":null,"errorMessage":"Unsupported token endpoint auth method: ${value}","messagePattern":"Unsupported token endpoint auth method: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/protocol/TokenEndpointAuthMethod.java","lineNumber":41,"sourceCode":"    TLS_CLIENT_AUTH(\"tls_client_auth\");\n\n    private final String value;\n\n    TokenEndpointAuthMethod(String value) {\n        this.value = value;\n    }\n\n    public String value() {\n        return value;\n    }\n\n    public static TokenEndpointAuthMethod fromValue(String value) {\n        for (TokenEndpointAuthMethod method : values()) {\n            if (method.value.equalsIgnoreCase(value)) {\n                return method;\n            }\n        }\n        throw new IllegalArgumentException(\"Unsupported token endpoint auth method: \" + value);\n    }\n}\n","sourceCodeStart":23,"sourceCodeEnd":44,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/protocol/TokenEndpointAuthMethod.java#L23-L44","documentation":"TokenEndpointAuthMethod.fromValue maps a string to the supported token-endpoint auth method enum (client_secret_basic, client_secret_post, private_key_jwt, etc.). If no enum constant matches the given value (case-insensitively), this IllegalArgumentException is thrown. The configured auth method is not supported by this client.","triggerScenarios":"Supplying an unsupported value for the token endpoint auth method in the OAuth2 client configuration — e.g. 'client_secret_jwt', 'none', 'basic', or a misspelled 'client_secred_post' — typically via the authParams/config map passed to the OAuth2 Authentication.","commonSituations":"Config values copied from an IdP's supported methods list that the Pulsar client doesn't implement; typos in YAML/JSON config; assuming 'none'/public-client auth is supported when only secret/JWT methods are.","solutions":["Change the configured value to one of the enum's supported methods (check TokenEndpointAuthMethod.values(): client_secret_basic, client_secret_post, private_key_jwt).","Fix typos and use the exact method name the IdP metadata advertises among the supported ones.","If the IdP requires an unsupported method, re-register the client with a supported auth method or use a different grant type."],"exampleFix":"// before\nconfig.put(\"tokenEndpointAuthMethod\", \"none\"); // throws\n// after\nconfig.put(\"tokenEndpointAuthMethod\", \"client_secret_basic\");","handlingStrategy":"validation","validationCode":"static void validateAuthMethod(String v) {\n    java.util.Set<String> supported = java.util.Set.of(\"client_secret_basic\", \"client_secret_post\", \"private_key_jwt\");\n    if (v == null || supported.stream().noneMatch(s -> s.equalsIgnoreCase(v))) {\n        throw new IllegalArgumentException(\"tokenEndpointAuthMethod must be one of \" + supported + \", got: \" + v);\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    client = AuthenticationFactoryOAuth2.clientCredentials(issuerUrl, credFile, audience);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Unsupported token endpoint auth method\")) {\n        throw new ConfigException(\"Use a supported method (client_secret_basic, client_secret_post, private_key_jwt)\", e);\n    }\n    throw e;\n}","preventionTips":["Only configure methods the client enum actually supports; cross-check with TokenEndpointAuthMethod.values().","Match the IdP-advertised token_endpoint_auth_methods_supported against the supported set before registering the client.","Avoid typos by centralizing the auth-method string in one config constant.","Don't assume 'none'/public-client flows are supported."],"tags":["oauth2","configuration","enum","authentication","pulsar-client"],"backgroundTag":"unsupported-auth-method","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}