grpc/grpc-java · error · ExtAuthzParseException

unsupported ExtAuthz service type: only grpc_service is supp

Error message

unsupported ExtAuthz service type: only grpc_service is supported

What it means

When parsing an Envoy ext_authz (external authorization) network filter config, gRPC xDS only supports the grpc_service variant for contacting the authorization server. If the ExtAuthz proto carries any other service type (e.g., http_service / http_uri) or no service at all, ExtAuthzConfigParser.parse throws ExtAuthzParseException with 'unsupported ExtAuthz service type: only grpc_service is supported'. The filter config is rejected and the associated xDS configuration update fails.

Source

Thrown at xds/src/main/java/io/grpc/xds/ExtAuthzConfigParser.java:52

 * Parser for {@link io.envoyproxy.envoy.extensions.filters.http.ext_authz.v3.ExtAuthz}.
 */
final class ExtAuthzConfigParser {

  private ExtAuthzConfigParser() {}

  /**
   * Parses the {@link io.envoyproxy.envoy.extensions.filters.http.ext_authz.v3.ExtAuthz} proto to
   * create an {@link ExtAuthzConfig} instance.
   *
   * @param extAuthzProto The ext_authz proto to parse.
   * @return An {@link ExtAuthzConfig} instance.
   * @throws ExtAuthzParseException if the proto is invalid or contains unsupported features.
   */
  public static ExtAuthzConfig parse(
      ExtAuthz extAuthzProto, BootstrapInfo bootstrapInfo, ServerInfo serverInfo)
      throws ExtAuthzParseException {
    if (!extAuthzProto.hasGrpcService()) {
      throw new ExtAuthzParseException(
          "unsupported ExtAuthz service type: only grpc_service is supported");
    }
    GrpcServiceConfig grpcServiceConfig;
    try {
      grpcServiceConfig =
          GrpcServiceConfigParser.parse(extAuthzProto.getGrpcService(), bootstrapInfo, serverInfo);
    } catch (GrpcServiceParseException e) {
      throw new ExtAuthzParseException("Failed to parse GrpcService config: " + e.getMessage(), e);
    }
    ExtAuthzConfig.Builder builder = ExtAuthzConfig.builder().grpcService(grpcServiceConfig)
        .failureModeAllow(extAuthzProto.getFailureModeAllow())
        .failureModeAllowHeaderAdd(extAuthzProto.getFailureModeAllowHeaderAdd())
        .includePeerCertificate(extAuthzProto.getIncludePeerCertificate())
        .denyAtDisable(extAuthzProto.getDenyAtDisable().getDefaultValue().getValue());

    if (extAuthzProto.hasFilterEnabled()) {
      try {
        builder.filterEnabled(

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Rewrite the ext_authz filter config to use grpc_service, specifying the xDS cluster name, authority, and timeout for the gRPC authorization server.
2. Ensure the referenced cluster for the gRPC authz service exists in the CDS configuration.
3. If only an HTTP authorization server exists, front it with a gRPC adapter or use an Envoy proxy for conversion, since gRPC-Java will not accept http_service.
4. Check the config with the Envoy/protobuf schema (ext_authz.proto) to confirm ext_authz.grpc_service is set before deploying.

Example fix

// before (rejected)
ext_authz {
  http_service { server_uri { uri: "auth:9000" } }
}
// after
ext_authz {
  grpc_service {
    envoy_grpc { cluster_name: "authz-cluster" }
    timeout { seconds: 1 }
  }
}

// validate before applying xDS config
if (!extAuthzProto.hasGrpcService()) {
  throw new IllegalArgumentException("ext_authz requires grpc_service");
}

try {
  ExtAuthzConfig cfg = ExtAuthzConfigParser.parse(proto, bootstrap, serverInfo);
} catch (ExtAuthzParseException e) {
  logger.error("Rejecting ext_authz config: " + e.getMessage());
  // keep serving with previous config (NACK the update)
}

When it happens

Trigger: An Envoy ext_authz filter in the received LDS/RDS (HTTP filter) configuration sets ext_authz.http_service (or leaves grpc_service unset), and the config is parsed via ExtAuthzConfigParser.parse during xDS config processing.

Common situations: Reusing an Envoy-side ext_authz config that points at an HTTP authorization service; forgetting to define grpc_service in the filter config; migrating Envoy HTTP-filter configs to gRPC-Java xDS which only implements the gRPC authz transport.

Related errors

• Invalid ring hash function: " + ringHash.getHashFunction()
• Custom LB config does not contain a JSON object
• Invalid header matcher config: [grpc-] prefixed header name
• Invalid header matcher config: header name [:scheme] is not
• Cluster " + cluster.getName() + ": unspecified cluster disco

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/4692c211cbbadb1c. Report an issue: GitHub.