apache/rocketmq · error · AuthorizationException

delete Acl from RocksDB failed.

Error message

delete Acl from RocksDB failed.

What it means

LocalAuthorizationMetadataProvider.deleteAcl() wraps failures from removing a subject's key from the local RocksDB ACL store (delete + flushWAL). As with create/update, the meaningful diagnostic is the nested cause: RocksDB I/O failure, closed handle, or encoding problems with the subject key.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/provider/LocalAuthorizationMetadataProvider.java:102

            byte[] valueBytes = JSON.toJSONBytes(acl);
            this.storage.put(AUTH_METADATA_COLUMN_FAMILY, keyBytes, keyBytes.length, valueBytes);
            this.storage.flushWAL();
            this.aclCache.invalidate(subject.getSubjectKey());
        } catch (Exception e) {
            throw new AuthorizationException("create Acl to RocksDB failed.", e);
        }
        return CompletableFuture.completedFuture(null);
    }

    @Override
    public CompletableFuture<Void> deleteAcl(Subject subject) {
        try {
            byte[] keyBytes = subject.getSubjectKey().getBytes(StandardCharsets.UTF_8);
            this.storage.delete(AUTH_METADATA_COLUMN_FAMILY, keyBytes);
            this.storage.flushWAL();
            this.aclCache.invalidate(subject.getSubjectKey());
        } catch (Exception e) {
            throw new AuthorizationException("delete Acl from RocksDB failed.", e);
        }
        return CompletableFuture.completedFuture(null);
    }

    @Override
    public CompletableFuture<Void> updateAcl(Acl acl) {
        try {
            Subject subject = acl.getSubject();
            byte[] keyBytes = subject.getSubjectKey().getBytes(StandardCharsets.UTF_8);
            byte[] valueBytes = JSON.toJSONBytes(acl);
            this.storage.put(AUTH_METADATA_COLUMN_FAMILY, keyBytes, keyBytes.length, valueBytes);
            this.storage.flushWAL();
            this.aclCache.invalidate(subject.getSubjectKey());
        } catch (Exception e) {
            throw new AuthorizationException("update Acl to RocksDB failed.", e);
        }
        return CompletableFuture.completedFuture(null);
    }

View on GitHub (pinned to 293f588571)

Solutions

  1. Read the nested cause to pinpoint the RocksDB-level failure
  2. Verify broker is fully started (store open) before issuing ACL deletions
  3. Check disk health and space on the auth config path
  4. If the store is corrupted, restore the acls directory from backup or recreate it and re-import the ACLs
Defensive patterns

Strategy: try-catch

Try / catch

try {
    provider.deleteAcl(subject).join();
} catch (CompletionException e) {
    Throwable real = ExceptionUtils.getRealException(e);
    // inspect real.getCause() for the RocksDB-level failure before retrying
}

Prevention

When it happens

Trigger: deleteAcl(subject) while RocksDB is unavailable (disk error, store closed during shutdown, corrupted column family) or when the subject key bytes cannot be encoded.

Common situations: Deleting ACLs during broker shutdown/restart windows; failing disk on the config volume; RocksDB directory corrupted after a crash.

Related errors

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/33ea036a3479449d. Report an issue: GitHub.