apache/pulsar · error · RestException

Don't have permission to access this topic

Error message

Don't have permission to access this topic

What it means

The WebSocket proxy validates that the authenticated role is authorized to produce, consume, or read the requested topic before proxying the connection. If all authorization checks (AuthorizationProvider, admin API lookup) complete without granting access, the endpoint throws this HTTP 401 RestException and rejects the WebSocket handshake.

Source

Thrown at pulsar-websocket/src/main/java/org/apache/pulsar/websocket/admin/WebSocketWebResource.java:142

     * @param topic
     * @throws RestException
     */
    protected void validateUserAccess(TopicName topic) {
        boolean isAuthorized = false;

        try {
            validateSuperUserAccess();
            isAuthorized = true;
        } catch (Exception e) {
            try {
                isAuthorized = isAuthorized(topic);
            } catch (Exception ne) {
                throw new RestException(ne);
            }
        }

        if (!isAuthorized) {
            throw new RestException(Status.UNAUTHORIZED, "Don't have permission to access this topic");
        }
    }

    /**
     * Checks if user is authorized to produce/consume on a given topic.
     *
     * @param topic
     * @return
     * @throws Exception
     */
    protected boolean isAuthorized(TopicName topic) throws Exception {
        if (service().isAuthorizationEnabled()) {
            return service().getAuthorizationService().canLookup(topic, clientAppId(), authData());
        }
        return true;
    }
}

View on GitHub (pinned to 820761864e)

Solutions

1. Grant the role access to the topic: pulsar-admin namespaces grant-permissions or topics set-permissions with the role used by the client's credentials
2. Fix the client's authentication (correct token/key, matching auth plugin and parameters in websocket.conf) so the intended role is authenticated
3. Verify websocket.conf brokerWebServiceUrl and auth provider settings so the proxy can perform authorization lookups
4. Check broker logs for exceptions in validateUserAccess that make the authorization check itself fail rather than return false

Example fix

// client shell: wrong/no token -> 401
ws://broker:8080/ws/reader/my-topic
// after adding auth:
ws://broker:8080/ws/reader/my-topic
Authorization: Bearer <token-for-role-with-access>  (or token query param)
// and/or grant access:
pulsar-admin topics grant-permissions persistent://public/default/my-topic --role app1 --actions produce,consume

// before opening the WS connection
boolean ok = admin.namespaces().getPermissions("public/default")
    .entrySet().stream()
    .anyMatch(e -> e.getKey().equals(myRole) &&
        e.getValue().contains(AuthAction.produce) ||
        e.getValue().contains(AuthAction.consume));
if (!ok) throw new IllegalStateException("role lacks access to topic");

try (Client wsClient = ... ) {
  wsClient.newConsumer().topic(topic).subscribe();
} catch (PulsarClientException e) {
  if (e.getStatusCode() == 401 || String.valueOf(e).contains("Don't have permission")) {
    log.error("Not authorized for topic {} — check role grants and auth config", topic);
    // do not retry; permissions must be fixed
  } else throw e;
}

When it happens

Trigger: A client connects to /ws/producer, /ws/consumer, or /ws/reader for a topic while its authenticated role lacks produce/consume/lookup permissions, or the AuthorizationProvider returns false / throws and no check sets isAuthorized=true.

Common situations: Missing namespace/topic-level grant for the role; wrong auth token or misconfigured authMethod so the proxy authorizes the wrong role; broker adminApiUrl or auth plugin misconfiguration in websocket.conf causing lookup failure; topic removed after URL was built.

Related errors

• Unauthorized to validateBothSuperuserAndBrokerOperation for
• Unauthorized to validateBrokerOperation for originalPrincipa
• Time-out while checking authorization
• Failed to get permissions
• Invalid combination of Original principal cannot be empty if

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/29a45d59e281c1cb. Report an issue: GitHub.