apache/rocketmq · error · AuthenticationException

authentication keyValues length is incorrect, actual length=

Error message

authentication keyValues length is incorrect, actual length={}.

What it means

After splitting the credential section on commas, one comma-separated item did not contain a '=' separator (split with limit 2 produced fewer than 2 parts). Each item must be a key=value pair such as 'Credential=alice' or 'Signature=abc123', so a bare token like 'alice' or a trailing comma yields this error.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authentication/builder/DefaultAuthenticationContextBuilder.java:71

            String authorization = metadata.get(GrpcConstants.AUTHORIZATION);
            if (StringUtils.isEmpty(authorization)) {
                return context;
            }
            String datetime = metadata.get(GrpcConstants.DATE_TIME);
            if (StringUtils.isEmpty(datetime)) {
                throw new AuthenticationException("datetime is null.");
            }

            String[] result = authorization.split(CommonConstants.SPACE, 2);
            if (result.length != 2) {
                throw new AuthenticationException("authentication header is incorrect.");
            }
            String[] keyValues = result[1].split(CommonConstants.COMMA);
            for (String keyValue : keyValues) {
                String[] kv = keyValue.trim().split(CommonConstants.EQUAL, 2);
                int kvLength = kv.length;
                if (kv.length != 2) {
                    throw new AuthenticationException("authentication keyValues length is incorrect, actual length={}.", kvLength);
                }
                String authItem = kv[0];
                if (CREDENTIAL.equals(authItem)) {
                    String[] credential = kv[1].split(CommonConstants.SLASH);
                    int credentialActualLength = credential.length;
                    if (credentialActualLength == 0) {
                        throw new AuthenticationException("authentication credential length is incorrect, actual length={}.", credentialActualLength);
                    }
                    context.setUsername(credential[0]);
                    continue;
                }
                if (SIGNATURE.equals(authItem)) {
                    context.setSignature(this.hexToBase64(kv[1]));
                }
            }

            context.setContent(datetime.getBytes(StandardCharsets.UTF_8));

View on GitHub (pinned to 293f588571)

Solutions

1. Ensure every comma-separated item in the header is 'Key=Value' with non-empty key and value, and that there are no double commas or trailing commas.
2. Build the header by joining only the non-empty 'Credential=...', 'Signature=...', 'DateTime=...' parts.
3. Use the SDK-provided signer so pairs are always well-formed.

Example fix

// before
String auth = "RocketMQ " + Stream.of(cred, sig, dt).collect(joining(",")); // sig may be empty -> 'Credential=u,,DateTime=d'

// after
String auth = "RocketMQ " + Stream.of(cred, sig, dt).filter(s -> s != null && !s.isEmpty()).collect(joining(","));

String[] pairs = {"Credential=" + user, "Signature=" + sig, "DateTime=" + dt};
for (String p : pairs) {
    int eq = p.indexOf('=');
    if (eq <= 0 || eq == p.length() - 1) throw new IllegalStateException("malformed auth pair: " + p);
}
String header = "RocketMQ " + String.join(",", pairs);

catch (AuthenticationException e) { log header shape (redacted values); treat as permanent client bug, do not retry. }

When it happens

Trigger: Authorization header where any comma-separated item lacks '=', e.g. 'RocketMQ Credential=alice,,Signature=xyz' (empty item from double comma) or 'RocketMQ alice,Signature=xyz'.

Common situations: Manually concatenated headers with a stray/doubled comma; values containing unescaped commas splitting a pair; templating code that emits an empty pair when one component (e.g. signature) is null.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• authentication header is incorrect.
• datetime is null.
• authentication credential length is incorrect, actual length
• create authentication context error.
• The authenticationMetadataProvider is not configured

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/96d191285df718b8. Report an issue: GitHub.