{"id":"fe8ef6ab32c7c9fd","repo":"apache/kafka","slug":"providerclassname-is-not-allowed-update-system-pr","errorCode":null,"errorMessage":"providerClassName is not allowed. Update System property 'AUTOMATIC_CONFIG_PROVIDERS_PROPERTY' to allow providerClassName","messagePattern":"providerClassName is not allowed\\. Update System property 'AUTOMATIC_CONFIG_PROVIDERS_PROPERTY' to allow providerClassName","errorType":"validation","errorClass":"ConfigException","httpStatus":null,"severity":"error","filePath":"clients/src/main/java/org/apache/kafka/common/config/AbstractConfig.java","lineNumber":623,"sourceCode":"            Map<String, ?> providerConfigProperties,\n            Predicate<String> classNameFilter\n    ) {\n        final String configProviders = indirectConfigs.get(CONFIG_PROVIDERS_CONFIG);\n\n        if (configProviders == null || configProviders.isEmpty()) {\n            return Map.of();\n        }\n\n        Map<String, String> providerMap = new HashMap<>();\n\n        for (String provider : configProviders.split(\",\")) {\n            String providerClass = providerClassProperty(provider);\n            if (indirectConfigs.containsKey(providerClass)) {\n                String providerClassName = indirectConfigs.get(providerClass);\n                if (classNameFilter.test(providerClassName)) {\n                    providerMap.put(provider, providerClassName);\n                } else {\n                    throw new ConfigException(providerClassName + \" is not allowed. Update System property '\"\n                            + AUTOMATIC_CONFIG_PROVIDERS_PROPERTY + \"' to allow \" + providerClassName);\n                }\n            }\n        }\n        // Instantiate Config Providers\n        Map<String, ConfigProvider> configProviderInstances = new HashMap<>();\n        for (Map.Entry<String, String> entry : providerMap.entrySet()) {\n            try {\n                String prefix = CONFIG_PROVIDERS_CONFIG + \".\" + entry.getKey() + CONFIG_PROVIDERS_PARAM;\n                Map<String, ?> configProperties = configProviderProperties(prefix, providerConfigProperties);\n                ConfigProvider provider = Utils.newInstance(entry.getValue(), ConfigProvider.class);\n                provider.configure(configProperties);\n                configProviderInstances.put(entry.getKey(), provider);\n            } catch (ClassNotFoundException e) {\n                log.error(\"Could not load config provider class {}\", entry.getValue(), e);\n                throw new ConfigException(providerClassProperty(entry.getKey()), entry.getValue(), \"Could not load config provider class or one of its dependencies\");\n            }\n        }","sourceCodeStart":605,"sourceCodeEnd":641,"githubUrl":"https://github.com/apache/kafka/blob/c31c9215e131f8c17e79f8901b48c13ee6aa8e7a/clients/src/main/java/org/apache/kafka/common/config/AbstractConfig.java#L605-L641","documentation":"ConfigException thrown by instantiateConfigProviders when an *automatic* (implicit) config provider's class name is not on the allowlist. Kafka resolves ${provider:[path:]key} variables in config values; when a variable references a provider that was not explicitly declared via the 'config.providers' setting (so it is being auto-instantiated), the class name must pass a classNameFilter derived from the system property org.apache.kafka.automatic.config.providers. If unset, all classes are allowed (filter is 'always true'); if set, only the comma-separated listed class names pass. The exception names the rejected class and tells you how to allow it.","triggerScenarios":"A config value contains a variable like ${file:/etc/app/db.properties:password} or ${vault:secret/path:key}; 'file'/'vault' were not declared under 'config.providers', so they are treated as automatic providers. The JVM was started with -Dorg.apache.kafka.automatic.config.providers=some,classes (non-empty), and the resolved provider class (e.g. org.apache.kafka.common.config.provider.FileConfigProvider) is not in that list, so classNameFilter.test(...) returns false and the exception fires.","commonSituations":"See trigger scenarios.","solutions":["Add the rejected class name (shown verbatim in the message) to the JVM system property: -Dorg.apache.kafka.automatic.config.providers=org.apache.kafka.common.config.provider.FileConfigProvider (comma-separated for multiple).","Prefer declaring the provider explicitly via 'config.providers=file' and 'config.providers.file.class=org.apache.kafka.common.config.provider.FileConfigProvider' instead of relying on automatic resolution; explicitly-declared providers bypass the allowlist.","Verify the FQCN matches exactly (mind shading/relocation that renames packages).","If running in a container/K8s, ensure the -D flag is actually applied to the JVM running Kafka/Connect/Streams (not just the shell)."],"exampleFix":"// before: JVM started with a restrictive allowlist that omits FileConfigProvider\n//   -Dorg.apache.kafka.automatic.config.providers=org.apache.kafka.common.config.provider.DirectoryConfigProvider\n// and a config value uses ${file:/etc/app/app.properties:db.url}\n\n// after: add FileConfigProvider to the allowlist\n//   -Dorg.apache.kafka.automatic.config.providers=org.apache.kafka.common.config.provider.DirectoryConfigProvider,org.apache.kafka.common.config.provider.FileConfigProvider","handlingStrategy":"validation","validationCode":"// Explicitly allow only the providers you trust via the system property BEFORE the\n// AbstractConfig is constructed.\nString providers = \"file,classpath,env\"; // your chosen allowlist of FQCNs\nSystem.setProperty(\n    org.apache.kafka.common.config.AbstractConfig.AUTOMATIC_CONFIG_PROVIDERS_PROPERTY,\n    providers);\n// Then construct your config; only listed FQCNs will be accepted by the framework.\n// Do NOT put arbitrary user-supplied class names in `config.providers`.","typeGuard":null,"tryCatchPattern":"try {\n    AbstractConfig cfg = new MyConfigDef().parse(props);\n} catch (org.apache.kafka.common.config.ConfigException ce) {\n    if (ce.getMessage().endsWith(\"Update System property '\" +\n            org.apache.kafka.common.config.AbstractConfig.AUTOMATIC_CONFIG_PROVIDERS_PROPERTY\n            + \"' to allow \" + props.get(\"config.providers.file.class\"))) {\n        // either allowlist it explicitly or remove the provider from the config\n        log.error(\"ConfigProvider not allowlisted; set -Dorg.apache.kafka.automatic.config.providers=<fqcn>\");\n    } else {\n        throw ce;\n    }\n}","preventionTips":["Set the JVM flag -Dorg.apache.kafka.automatic.config.providers=<comma-separated FQCNs> in your startup script.","Treat config provider class names as privileged input — never accept them from end-user config files.","Pin the allowlist in code/infra, not in the same config file that requests the providers, to avoid self-authorization.","This guard exists to prevent a malicious external config from loading arbitrary code; keep it strict."],"tags":["configuration","kafka-client","config-providers","security","jvm-properties"],"analyzedSha":"c31c9215e131f8c17e79f8901b48c13ee6aa8e7a","analyzedAt":"2026-08-03T12:34:05.770Z","schemaVersion":2}