apache/rocketmq · error · AuthorizationException

Authorization failed. Please verify your access rights and t

Error message

Authorization failed. Please verify your access rights and try again.

What it means

AbstractAuthorizationStrategy.authorize() catches any Throwable from the authorization provider that is not already an AuthorizationException (after unwrapping via ExceptionUtils.getRealException) and rethrows it as a generic AuthorizationException with the message 'Authorization failed. Please verify your access rights and try again.' It means the authorization pipeline itself broke — metadata store errors, timeout, or unexpected runtime exceptions — rather than a clean deny decision.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/strategy/AbstractAuthorizationStrategy.java:72

        if (!this.authConfig.isAuthorizationEnabled()) {
            return;
        }
        if (this.authorizationProvider == null) {
            return;
        }
        if (this.authorizationWhiteSet.contains(context.getRpcCode())) {
            return;
        }
        try {
            this.authorizationProvider.authorize(context).join();
        } catch (AuthorizationException ex) {
            throw ex;
        } catch (Throwable ex) {
            Throwable exception = ExceptionUtils.getRealException(ex);
            if (exception instanceof AuthorizationException) {
                throw (AuthorizationException) exception;
            }
            throw new AuthorizationException("Authorization failed. Please verify your access rights and try again.", exception);
        }
    }
}

View on GitHub (pinned to 293f588571)

Solutions

1. Read the server log for the wrapped cause — the real exception is logged/attached and tells whether it is storage, plugin, or network
2. If caused by the local RocksDB store, fix the store issue (lock contention, disk, corruption) per error 85/89 guidance
3. If a custom AuthorizationProvider is plugged in, make it throw AuthorizationException for expected failures instead of raw runtime exceptions
4. Temporarily verify the client credentials are valid to rule out an authentication-stage failure being surfaced here

try {
    // client side: any RPC while authorization enabled
    producer.send(msg);
} catch (MQClientException | RemotingException e) {
    if (String.valueOf(e).contains("Authorization failed")) {
        // check broker logs; verify ACL/RPC access and credential configuration
    }
}

When it happens

Trigger: Any RPC request on a non-whitelisted code while the authorization provider throws a non-AuthorizationException: RocksDB ACL store failure inside LocalAuthorizationMetadataProvider, CompletableFuture completion errors, or NPEs in a custom AuthorizationProvider implementation.

Common situations: The ACL RocksDB store is locked/corrupt so lookups blow up mid-request; a custom authorization provider plugin throwing runtime exceptions; auth metadata service (e.g. remote backend) unreachable causing unexpected exception types.

Related errors

• The actions is empty.
• The actions can not be Any.
• The source ip is empty.
• The source ip is invalid.
• The decision is null or illegal.

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/a9882d92236b9c49. Report an issue: GitHub.