apache/rocketmq · error · AuthorizationException

authorization context is empty.

Error message

authorization context is empty.

What it means

Error "authorization context is empty." thrown in apache/rocketmq.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/AuthorizationEvaluator.java:51

    public AuthorizationEvaluator(AuthConfig authConfig) {
        this(authConfig, null);
    }

    public AuthorizationEvaluator(AuthConfig authConfig, Supplier<?> metadataService) {
        this.authorizationStrategy = AuthorizationFactory.getStrategy(authConfig, metadataService);
    }

    /**
     * Visible for testing: allows injecting a stub strategy.
     */
    AuthorizationEvaluator(AuthorizationStrategy authorizationStrategy) {
        this.authorizationStrategy = authorizationStrategy;
    }

    public void evaluate(List<? extends AuthorizationContext> contexts) {
        if (CollectionUtils.isEmpty(contexts)) {
            throw new AuthorizationException("authorization context is empty.");
        }
        contexts.forEach(this.authorizationStrategy::evaluate);
    }

    public void evaluate(RemotingCommand request, List<? extends AuthorizationContext> contexts) {
        if (CollectionUtils.isNotEmpty(contexts)) {
            contexts.forEach(this.authorizationStrategy::evaluate);
            return;
        }
        if (!AuthorizationCompatibility.matches(request)) {
            throw new AuthorizationException("authorization context is empty.");
        }
    }

    public void evaluate(GeneratedMessageV3 request, List<? extends AuthorizationContext> contexts) {
        if (CollectionUtils.isNotEmpty(contexts)) {
            contexts.forEach(this.authorizationStrategy::evaluate);
            return;

View on GitHub (pinned to 293f588571)

Solutions

1. Ensure the request carries the required authorization metadata (topic/group, actions) so the AuthorizationContextBuilder can build a non-empty context.
2. Verify the request type is one that produces an authorization context; unsupported request types yield empty contexts.
3. Check that the client populates all required headers/fields before sending the request.

When it happens

Trigger: Occurs when the authorization evaluator is invoked with an empty or missing authorization context.

Common situations: Authorization context builder produced no context because required request fields were absent or a preceding build step failed.

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/ef639d98e8484501. Report an issue: GitHub.