Pulsar "AuthenticationException" in CI

By Daniel Zoghalchali·Latchkey

The broker has authentication enabled and rejected the client. The client either sent no credentials, sent a token signed by a key the broker does not trust, or used a token that has expired.

What this error means

The client fails with "org.apache.pulsar.client.api.PulsarClientException$AuthenticationException: Failed to authenticate" on connect.

Terminal

org.apache.pulsar.client.api.PulsarClientException$AuthenticationException:
Failed to authenticate

Common causes

No token on an authenticated broker

The broker requires a token but the client connected without an authentication plugin configured.

Token not trusted or expired

The token is signed by a key the broker does not have, or its expiry has passed, so authentication fails.

How to fix it

Provide a matching token to the client

Configure the JWT auth plugin with the token the broker was started to trust.

.github/workflows/ci.yml

env:
  PULSAR_AUTH_PLUGIN: org.apache.pulsar.client.impl.auth.AuthenticationToken
  PULSAR_AUTH_PARAMS: token:${{ secrets.PULSAR_TOKEN }}

Disable auth for an isolated test broker

If the test broker does not need auth, run standalone without authentication so the client connects cleanly.

Start Pulsar standalone with authentication disabled for tests.
Remove the auth plugin from the client config.
Re-run so the connection no longer requires a token.

How to prevent it

Inject Pulsar tokens from CI secrets, never committed config.
Keep the broker trust key and client token in sync.
Use unauthenticated standalone for isolated test brokers.

Frequently asked questions

What causes "Pulsar "AuthenticationException""?