apache/rocketmq · error · AuthorizationException

group is null.

Error message

group is null.

What it means

Thrown by newSubContexts when resourceType is GROUP and the supplied apache.rocketmq.v2.Resource is null or has a blank name: AuthorizationException('group is null.'). Reached from the telemetry SETTINGS path (subscription.group) and group-subscription wrappers; the group name is required to build the group Resource a SUB action is authorized against.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/builder/DefaultAuthorizationContextBuilder.java:805

        result.addAll(newTopicSubContexts(metadata, topic));
        return result;
    }

    private static List<DefaultAuthorizationContext> newTopicSubContexts(Metadata metadata,
        apache.rocketmq.v2.Resource resource) {
        return newSubContexts(metadata, ResourceType.TOPIC, resource);
    }

    private static List<DefaultAuthorizationContext> newGroupSubContexts(Metadata metadata,
        apache.rocketmq.v2.Resource resource) {
        return newSubContexts(metadata, ResourceType.GROUP, resource);
    }

    private static List<DefaultAuthorizationContext> newSubContexts(Metadata metadata, ResourceType resourceType,
        apache.rocketmq.v2.Resource resource) {
        if (resourceType == ResourceType.GROUP) {
            if (resource == null || StringUtils.isBlank(resource.getName())) {
                throw new AuthorizationException("group is null.");
            }
            return newSubContexts(metadata, Resource.ofGroup(resource.getName()));
        }
        if (resourceType == ResourceType.TOPIC) {
            if (resource == null || StringUtils.isBlank(resource.getName())) {
                throw new AuthorizationException("topic is null.");
            }
            return newSubContexts(metadata, Resource.ofTopic(resource.getName()));
        }
        throw new AuthorizationException("unknown resource type.");
    }

    private static List<DefaultAuthorizationContext> newSubContexts(Metadata metadata, Resource resource) {
        List<DefaultAuthorizationContext> result = new ArrayList<>();
        Subject subject = null;
        if (metadata.containsKey(GrpcConstants.AUTHORIZATION_AK)) {
            subject = User.of(metadata.get(GrpcConstants.AUTHORIZATION_AK));
        }

View on GitHub (pinned to 293f588571)

Solutions

1. Set a non-blank group name: subscription.setGroup(Resource.newBuilder().setName(consumerGroup)).
2. Validate consumerGroup config at client startup before establishing the gRPC session.
3. Use the official client, which requires a group when subscribing.

Example fix

// before
Subscription sub = Subscription.newBuilder()
    .addSubscriptions(entry).build(); // group never set

// after
Subscription sub = Subscription.newBuilder()
    .setGroup(Resource.newBuilder().setName(consumerGroup))
    .addSubscriptions(entry).build();

if (consumerGroup == null || consumerGroup.isBlank()) {
    throw new IllegalArgumentException("consumer group required for subscription settings");
}
Subscription sub = Subscription.newBuilder()
    .setGroup(Resource.newBuilder().setName(consumerGroup)).build();

static boolean isNamedResource(apache.rocketmq.v2.Resource r) {
    return r != null && !r.getName().isBlank();
}

try { telemetry(settingsCmd); }
catch (AuthorizationException e) {
    if ("group is null.".equals(e.getMessage())) { setGroupAndResend(consumerGroup); return; }
    throw e;
}

When it happens

Trigger: A gRPC SETTINGS command whose subscription section is present but whose group Resource is unset (Subscription.newBuilder().setGroup(Resource.newBuilder().build())) or has an empty name — i.e. the client declared subscriptions without identifying its consumer group. The same helper throws 'topic is null.' for the TOPIC variant on each subscription entry.

Common situations: Custom gRPC consumers omitting the group when they only want push/pop without a declared group; config-driven subscription builders where the group property is missing in one environment; clients ported from the remoting protocol that forgot the gRPC group is part of settings.

Related errors

• subscription group list is empty.
• topic is null.
• settings command doesn't have publishing or subscription.
• cidAll is null or cidAll empty
• consumerGroup is null

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/6427ec7a9dff4b4d. Report an issue: GitHub.