apache/rocketmq · error · AuthorizationException

retry topic does not match consumer group.

Error message

retry topic does not match consumer group.

What it means

Error "retry topic does not match consumer group." thrown in apache/rocketmq.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/builder/DefaultAuthorizationContextBuilder.java:275

                    }
                    break;
                case RequestCode.VIEW_MESSAGE_BY_ID:
                    if (StringUtils.isNotBlank(fields.get(TOPIC))) {
                        topic = Resource.ofTopic(fields.get(TOPIC));
                        result.add(DefaultAuthorizationContext.of(subject, topic, Action.GET, sourceIp));
                    }
                    break;
                case RequestCode.CONSUMER_SEND_MSG_BACK:
                    group = Resource.ofGroup(requireResource(fields.get(GROUP), "consumer group"));
                    result.add(DefaultAuthorizationContext.of(subject, group, Action.SUB, sourceIp));
                    break;
                case RequestCode.PULL_MESSAGE:
                case RequestCode.LITE_PULL_MESSAGE:
                    String pullTopic = requireResource(fields.get(TOPIC), "topic");
                    String pullGroup = requireResource(fields.get(CONSUMER_GROUP), "consumer group");
                    if (NamespaceUtil.isRetryTopic(pullTopic)) {
                        if (!StringUtils.equals(pullTopic, MixAll.getRetryTopic(pullGroup))) {
                            throw new AuthorizationException("retry topic does not match consumer group.");
                        }
                    } else {
                        topic = Resource.ofTopic(pullTopic);
                        result.add(DefaultAuthorizationContext.of(subject, topic, Action.SUB, sourceIp));
                    }
                    group = Resource.ofGroup(pullGroup);
                    result.add(DefaultAuthorizationContext.of(subject, group, Action.SUB, sourceIp));
                    break;
                case RequestCode.BATCH_ACK_MESSAGE:
                    BatchAckMessageRequestBody batchAckBody = decodeRequiredBody(
                        command, BatchAckMessageRequestBody.class, "batch ack");
                    if (CollectionUtils.isEmpty(batchAckBody.getAcks())) {
                        throw new AuthorizationException("batch ack is empty.");
                    }
                    Set<String> ackResources = new LinkedHashSet<>();
                    for (BatchAck ack : batchAckBody.getAcks()) {
                        if (ack == null) {
                            throw new AuthorizationException("batch ack entry is null.");

View on GitHub (pinned to 293f588571)

Solutions

1. Use the retry topic that corresponds to the consumer group (%RETRY%+consumerGroup) when sending retry-related requests.
2. Verify the consumer group name in the request matches the retry topic being accessed.
3. Avoid hand-crafting retry topics; let the client library derive them from the consumer group.

When it happens

Trigger: Occurs when the retry topic derived from a request does not match the consumer group supplied in the request.

Common situations: Client sends an ack or offset request against a retry topic (%RETRY%group) whose group segment differs from the group in the request header.

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/3ebef3d6b6450f55. Report an issue: GitHub.