grpc/grpc-java · error · ExtAuthzParseException

Failed to parse GrpcService config: ${e.getMessage()}

Error message

Failed to parse GrpcService config: ${e.getMessage()}

What it means

ExtAuthzConfigParser.parse wraps any GrpcServiceParseException from GrpcServiceConfigParser.parse in an ExtAuthzParseException, prefixing with 'Failed to parse GrpcService config:'. It means the grpc_service section of the io.envoy.extensions.filters.http.ext_authz.v3.ExtAuthz proto in the xDS filter config is malformed or references unknown resources. The library throws it to abort building the ext_authz filter config early with a clear cause chain.

Source

Thrown at xds/src/main/java/io/grpc/xds/ExtAuthzConfigParser.java:60

   * create an {@link ExtAuthzConfig} instance.
   *
   * @param extAuthzProto The ext_authz proto to parse.
   * @return An {@link ExtAuthzConfig} instance.
   * @throws ExtAuthzParseException if the proto is invalid or contains unsupported features.
   */
  public static ExtAuthzConfig parse(
      ExtAuthz extAuthzProto, BootstrapInfo bootstrapInfo, ServerInfo serverInfo)
      throws ExtAuthzParseException {
    if (!extAuthzProto.hasGrpcService()) {
      throw new ExtAuthzParseException(
          "unsupported ExtAuthz service type: only grpc_service is supported");
    }
    GrpcServiceConfig grpcServiceConfig;
    try {
      grpcServiceConfig =
          GrpcServiceConfigParser.parse(extAuthzProto.getGrpcService(), bootstrapInfo, serverInfo);
    } catch (GrpcServiceParseException e) {
      throw new ExtAuthzParseException("Failed to parse GrpcService config: " + e.getMessage(), e);
    }
    ExtAuthzConfig.Builder builder = ExtAuthzConfig.builder().grpcService(grpcServiceConfig)
        .failureModeAllow(extAuthzProto.getFailureModeAllow())
        .failureModeAllowHeaderAdd(extAuthzProto.getFailureModeAllowHeaderAdd())
        .includePeerCertificate(extAuthzProto.getIncludePeerCertificate())
        .denyAtDisable(extAuthzProto.getDenyAtDisable().getDefaultValue().getValue());

    if (extAuthzProto.hasFilterEnabled()) {
      try {
        builder.filterEnabled(
            MatcherParser.parseFractionMatcher(extAuthzProto.getFilterEnabled().getDefaultValue()));
      } catch (IllegalArgumentException e) {
        throw new ExtAuthzParseException(e.getMessage());
      }
    }

    if (extAuthzProto.hasStatusOnError()) {
      builder.statusOnError(

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Read the wrapped GrpcServiceParseException cause to see the specific grpc_service field that failed and fix it in the LDS filter config.
2. Ensure ext_authz.grpc_service has a valid transport (google_grpc or grpc) with a resolvable target_uri present in the bootstrap server_info.
3. Check ClientXdsClient logs and the proto received from the management server for unexpected or unsupported fields.
4. Verify your control plane (Istio/Envoy admin) emits a grpc_service schema this grpc-java xDS version supports.

Example fix

// before (LDS ext_authz filter config)
"grpcService": { "targetUri": "ext-authz.default.svc:9000" }
// after — use the fully-qualified, bootstrap-matching target
"grpcService": { "googleGrpc": { "targetUri": "ext-authz.default.svc.cluster.local:9000", "statPrefix": "ext_authz" } }

// before submitting config, verify grpc_service basics in the ext_authz filter JSON
JSONObject cfg = /* filter config */;
JSONObject grpcService = cfg.optJSONObject("grpcService");
if (grpcService == null || (!grpcService.has("targetUri") && !grpcService.has("googleGrpc"))) {
    throw new IllegalArgumentException("ext_authz grpc_service missing target");
}

try { /* configure xDS channel */ } catch (ExtAuthzParseException e) { log.error("ext_authz grpc_service invalid: {}", e.getMessage(), e.getCause()); }

When it happens

Trigger: ClientXdsClient parsing an HTTP filter config whose ext_authz proto has a grpc_service that GrpcServiceConfigParser rejects — e.g. missing target Uri, invalid channel creds, unknown fields, or a server_info reference that doesn't resolve in the bootstrap.

Common situations: Misconfigured Envoy/ext_authz filter metadata in a control-plane LDS response; typo'd grpc_service target URI; referencing a GoogleGrpc settings block the Java parser doesn't support; bootstrap server_info names not matching the filter's authority.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• ${e.getMessage()}
• Unknown denominator type: ${proto.getDenominator()}
• Invalid Resource in address proto
• Audience URL is empty. Metadata value must contain a valid U
• Failed to parse access token credentials: " + e.getMessage()

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/1f20f992d25a5e68. Report an issue: GitHub.