apache/rocketmq · error · AuthorizationException

parse authorization context error.

Error message

parse authorization context error.

What it means

This is the catch-all in DefaultAuthorizationContextBuilder#build: any Throwable raised while parsing the request into authorization contexts — other than an AuthorizationException, which is rethrown as-is — is wrapped in AuthorizationException('parse authorization context error.', t). Typical causes are JSON decode failures in RemotingSerializable.decode (wrong body class for the request code), ClassCastException in decodeCommandCustomHeader, protobuf/parameter errors in the gRPC paths, or NPEs in unlisted request-code branches. The root cause is in the attached cause, so always log t.getCause().

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/builder/DefaultAuthorizationContextBuilder.java:615

                    for (String groupName : deleteGroupListRequestBody.getGroupNameList()) {
                        group = Resource.ofGroup(requireResource(groupName, "consumer group"));
                        addUniqueContext(result, deleteGroupResources, subject, group, Action.DELETE, sourceIp);
                    }
                    break;
                default:
                    result = buildContextByAnnotation(subject, command, sourceIp);
                    break;
            }
            if (CollectionUtils.isNotEmpty(result)) {
                result.forEach(r -> {
                    r.setChannelId(context.channel().id().asLongText());
                    r.setRpcCode(String.valueOf(command.getCode()));
                });
            }
        } catch (AuthorizationException ex) {
            throw ex;
        } catch (Throwable t) {
            throw new AuthorizationException("parse authorization context error.", t);
        }
        return result;
    }

    private static <T> T decodeRequiredBody(RemotingCommand command, Class<T> bodyClass, String bodyName) {
        if (command.getBody() == null || command.getBody().length == 0) {
            throw new AuthorizationException(bodyName + " is null.");
        }
        T body = RemotingSerializable.decode(command.getBody(), bodyClass);
        if (body == null) {
            throw new AuthorizationException(bodyName + " is null.");
        }
        return body;
    }

    private static String decodeRequiredText(RemotingCommand command, String bodyName) {
        if (command.getBody() == null || command.getBody().length == 0) {
            throw new AuthorizationException(bodyName + " is null.");

View on GitHub (pinned to 293f588571)

Solutions

1. Inspect the cause: catch and log ex.getCause() to identify the actual decode/parse failure.
2. Match request code to payload — send the body/header class the broker's builder expects for that RequestCode (check the switch cases in DefaultAuthorizationContextBuilder).
3. Align client and broker versions so request-code handling and body schemas agree.
4. If writing a custom request code, make sure the default annotation path can resolve its headers.

Example fix

// before
catch (Exception e) { log.error("auth failed", e.getMessage()); }

// after
catch (AuthorizationException e) {
    Throwable cause = e.getCause();
    log.error("auth context parse failed, root:", cause != null ? cause : e);
}

try { authorizer.authorize(context); }
catch (AuthorizationException e) {
    Throwable root = e.getCause() != null ? e.getCause() : e;
    log.error("auth context parse failed; root cause:", root); // decode errors hide here
    throw e;
}

When it happens

Trigger: Any request whose body/header cannot be parsed by the branch selected for its RequestCode: sending non-JSON bytes where a JSON body is expected, sending the wrong request code for the payload, malformed UTF-8, or a header class mismatch in decodeCommandCustomHeader. Since the default branch delegates to buildContextByAnnotation, annotation-driven codes with broken headers also land here.

Common situations: Client/broker version mismatch where the request-code-to-body mapping changed; hand-crafted RemotingCommand with an empty or binary body on an admin code; gzipped or encrypted bodies sent to codes the builder expects to decode plainly.

Related errors

• User:{} is not found
• topic list is empty.
• topic config is null.
• cold data flow config is empty.
• subscription group is null.

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/b0a1fb95f49dadaa. Report an issue: GitHub.