apache/rocketmq · error · AuthenticationException

password can not be blank

Error message

password can not be blank

What it means

The validator requires a non-blank password when isCreate is true, so createUser without a password is rejected. The password doubles as the HMAC secret for that user's signature verification, hence it cannot be empty at creation. updateUser is exempt because password changes are optional there.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authentication/manager/AuthenticationMetadataManagerImpl.java:200

    @Override
    public CompletableFuture<Boolean> isSuperUser(String username) {
        return this.getUser(username).thenApply(user -> {
            if (user == null) {
                throw new AuthenticationException("User:{} is not found", username);
            }
            return user.getUserType() == UserType.SUPER;
        });
    }

    private void validate(User user, boolean isCreate) {
        if (user == null) {
            throw new AuthenticationException("user can not be null");
        }
        if (StringUtils.isBlank(user.getUsername())) {
            throw new AuthenticationException("username can not be blank");
        }
        if (isCreate && StringUtils.isBlank(user.getPassword())) {
            throw new AuthenticationException("password can not be blank");
        }
    }

    private void handleException(Exception e, CompletableFuture<?> result) {
        Throwable throwable = ExceptionUtils.getRealException(e);
        result.completeExceptionally(throwable);
    }

    private AuthenticationMetadataProvider getAuthenticationMetadataProvider() {
        if (authenticationMetadataProvider == null) {
            throw new IllegalStateException("The authenticationMetadataProvider is not configured.");
        }
        return authenticationMetadataProvider;
    }

    private AuthorizationMetadataProvider getAuthorizationMetadataProvider() {
        if (authorizationMetadataProvider == null) {
            throw new IllegalStateException("The authorizationMetadataProvider is not configured.");

View on GitHub (pinned to 293f588571)

Solutions

1. Provide a non-blank password at creation: mqadmin createUser -u <user> -p <password>, or User.of(username, password).
2. If passwords come from a request DTO, mark the field required for create operations and validate before calling the manager.
3. For automated flows, generate a random secret client-side and pass it (the manager will not invent one).

Example fix

// before
authManager.createUser(User.builder().username("alice").build()); // no password

// after
String initialSecret = RandomStringUtils.randomAlphanumeric(24);
authManager.createUser(User.builder().username("alice").password(initialSecret).build());

// Create-path guard
if (isCreate && StringUtils.isBlank(user.getPassword())) {
    throw new IllegalArgumentException("password is required when creating a user");
}

boolean isCreateValid(User u) { return u != null && isNotBlank(u.getUsername()) && isNotBlank(u.getPassword()); }

catch (AuthenticationException e) { if message contains "password can not be blank" -> collect as form-validation error and re-prompt; do not call createUser again without a password. }

When it happens

Trigger: createUser with a User whose password is null, empty, or whitespace-only - commonly an admin API that forwards a request body where the password field was omitted (intending server-side generation).

Common situations: Creating users from forms/scripts where the password parameter was dropped; API clients assuming the server generates a default password; trimming logic that reduces the password to empty.

Related errors

• username can not be blank
• user can not be null
• authentication credential length is incorrect, actual length
• User:{} is not found.
• The user is existed

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/c60c78e204c47377. Report an issue: GitHub.