apache/rocketmq · error · AuthorizationException

subscription group is null.

Error message

subscription group is null.

What it means

Thrown for UPDATE_AND_CREATE_SUBSCRIPTIONGROUP when the request body either fails to decode to a SubscriptionGroupConfig (decode returns null) or decodes but has a blank groupName. The group name is required to build the Resource.ofGroup(...) that the CREATE action is checked against, so without it the request is rejected before authorization proper.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/builder/DefaultAuthorizationContextBuilder.java:502

                    }
                    Set<String> coldDataResources = new LinkedHashSet<>();
                    for (String consumerGroup : properties.stringPropertyNames()) {
                        addUniqueContext(result, coldDataResources, subject,
                            Resource.ofGroup(requireResource(consumerGroup, "consumer group")),
                            Action.UPDATE, sourceIp);
                    }
                    break;
                case RequestCode.REMOVE_COLD_DATA_FLOW_CTR_CONFIG:
                    group = Resource.ofGroup(requireResource(
                        decodeRequiredText(command, "consumer group"), "consumer group"));
                    result.add(DefaultAuthorizationContext.of(subject, group, Action.UPDATE, sourceIp));
                    break;
                case RequestCode.UPDATE_AND_CREATE_SUBSCRIPTIONGROUP:
                    SubscriptionGroupConfig subscriptionGroupConfig =
                        RemotingSerializable.decode(command.getBody(), SubscriptionGroupConfig.class);
                    if (subscriptionGroupConfig == null
                        || StringUtils.isBlank(subscriptionGroupConfig.getGroupName())) {
                        throw new AuthorizationException("subscription group is null.");
                    }
                    result.add(DefaultAuthorizationContext.of(subject,
                        Resource.ofGroup(subscriptionGroupConfig.getGroupName()), Action.CREATE, sourceIp));
                    break;
                case RequestCode.UPDATE_AND_CREATE_SUBSCRIPTIONGROUP_LIST:
                    SubscriptionGroupList subscriptionGroupList = decodeRequiredBody(
                        command, SubscriptionGroupList.class, "subscription group list");
                    if (CollectionUtils.isEmpty(subscriptionGroupList.getGroupConfigList())) {
                        throw new AuthorizationException("subscription group list is empty.");
                    }
                    Set<String> subscriptionGroupResources = new LinkedHashSet<>();
                    for (SubscriptionGroupConfig groupConfig : subscriptionGroupList.getGroupConfigList()) {
                        if (groupConfig == null) {
                            throw new AuthorizationException("subscription group config is null.");
                        }
                        addUniqueContext(result, subscriptionGroupResources, subject,
                            Resource.ofGroup(requireResource(groupConfig.getGroupName(), "consumer group")),
                            Action.CREATE, sourceIp);

View on GitHub (pinned to 293f588571)

Solutions

1. Set a non-blank groupName in the SubscriptionGroupConfig before serializing the body.
2. Verify the body JSON round-trips: RemotingSerializable.decode(bytes, SubscriptionGroupConfig.class) returns a config with a non-empty group name.
3. Use requireResource-style validation on the client whenever a group name comes from user input.

Example fix

// before
SubscriptionGroupConfig cfg = new SubscriptionGroupConfig();
cfg.setGroupName(request.getGroup()); // may be null/blank

// after
String group = request.getGroup();
if (StringUtils.isBlank(group)) { throw new IllegalArgumentException("group required"); }
SubscriptionGroupConfig cfg = new SubscriptionGroupConfig();
cfg.setGroupName(group);

if (config == null || StringUtils.isBlank(config.getGroupName())) {
    throw new IllegalArgumentException("subscription group name required");
}

try { admin.createAndUpdateSubscriptionGroupConfig(config); }
catch (AuthorizationException e) {
    if ("subscription group is null.".equals(e.getMessage())) { promptForGroupName(); return; }
    throw e;
}

When it happens

Trigger: Calling mqadmin updateSubGroup / the broker admin API with a body whose JSON is not a SubscriptionGroupConfig, or one whose 'groupName' field is missing, empty, or whitespace. Note this path uses RemotingSerializable.decode directly (no decodeRequiredBody wrapper), so malformed JSON may instead surface as the generic 'parse authorization context error.' — a null decode or blank name is what reaches this exact message.

Common situations: Creating a subscription group with an empty name field in an ops UI; sending the wrong object type in the body after a client/broker version mismatch; groupName trimmed to empty by upstream templating.

Related errors

• subscription group config is null.
• topic config is null.
• subscription group list is empty.
• topic list is empty.
• is null.

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/7cd0651351aeed04. Report an issue: GitHub.