apache/rocketmq · error · AuthorizationException

subscription group list is empty.

Error message

subscription group list is empty.

What it means

Thrown for UPDATE_AND_CREATE_SUBSCRIPTIONGROUP_LIST when the decoded SubscriptionGroupList body has a null or empty groupConfigList. Analogous to the topic-list check: each SubscriptionGroupConfig would yield a group Resource for a CREATE authorization, so an empty list is rejected with AuthorizationException rather than creating zero contexts.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/builder/DefaultAuthorizationContextBuilder.java:511

                    group = Resource.ofGroup(requireResource(
                        decodeRequiredText(command, "consumer group"), "consumer group"));
                    result.add(DefaultAuthorizationContext.of(subject, group, Action.UPDATE, sourceIp));
                    break;
                case RequestCode.UPDATE_AND_CREATE_SUBSCRIPTIONGROUP:
                    SubscriptionGroupConfig subscriptionGroupConfig =
                        RemotingSerializable.decode(command.getBody(), SubscriptionGroupConfig.class);
                    if (subscriptionGroupConfig == null
                        || StringUtils.isBlank(subscriptionGroupConfig.getGroupName())) {
                        throw new AuthorizationException("subscription group is null.");
                    }
                    result.add(DefaultAuthorizationContext.of(subject,
                        Resource.ofGroup(subscriptionGroupConfig.getGroupName()), Action.CREATE, sourceIp));
                    break;
                case RequestCode.UPDATE_AND_CREATE_SUBSCRIPTIONGROUP_LIST:
                    SubscriptionGroupList subscriptionGroupList = decodeRequiredBody(
                        command, SubscriptionGroupList.class, "subscription group list");
                    if (CollectionUtils.isEmpty(subscriptionGroupList.getGroupConfigList())) {
                        throw new AuthorizationException("subscription group list is empty.");
                    }
                    Set<String> subscriptionGroupResources = new LinkedHashSet<>();
                    for (SubscriptionGroupConfig groupConfig : subscriptionGroupList.getGroupConfigList()) {
                        if (groupConfig == null) {
                            throw new AuthorizationException("subscription group config is null.");
                        }
                        addUniqueContext(result, subscriptionGroupResources, subject,
                            Resource.ofGroup(requireResource(groupConfig.getGroupName(), "consumer group")),
                            Action.CREATE, sourceIp);
                    }
                    break;
                case RequestCode.UPDATE_AND_CREATE_STATIC_TOPIC:
                    CreateTopicRequestHeader createTopicRequestHeader =
                        command.decodeCommandCustomHeader(CreateTopicRequestHeader.class);
                    if (createTopicRequestHeader == null) {
                        throw new AuthorizationException("topic header is null.");
                    }
                    String staticTopic = requireResource(createTopicRequestHeader.getTopic(), "topic");

View on GitHub (pinned to 293f588571)

Solutions

1. Skip the RPC when the group config list is empty — it is a no-op anyway.
2. Ensure the serialized body contains a non-empty 'groupConfigList' array with the exact field name the broker expects.
3. Assert list size matches the number of source entries before serializing.

Example fix

// before
body.setGroupConfigList(groups); // groups may be empty
admin.updateSubscriptionGroupList(body);

// after
if (groups == null || groups.isEmpty()) { return; }
body.setGroupConfigList(groups);
admin.updateSubscriptionGroupList(body);

if (CollectionUtils.isEmpty(groupConfigList)) { return; }
body.setGroupConfigList(groupConfigList);

try { admin.updateSubscriptionGroupList(body); }
catch (AuthorizationException e) {
    if (e.getMessage().contains("subscription group list is empty")) { return; }
    throw e;
}

When it happens

Trigger: Sending RequestCode.UPDATE_AND_CREATE_SUBSCRIPTIONGROUP_LIST with a body missing the 'groupConfigList' key, or with an empty array. Typically hit through bulk subscription-group creation APIs or tooling that batches SubscriptionGroupConfig objects.

Common situations: Bulk group provisioning from an empty config file or a filtered list that ended up empty; wrong JSON field name in a hand-rolled client so the list stays null after decode.

Related errors

• topic list is empty.
• subscription group is null.
• subscription group config is null.
• The body of acl is null
• topic config is null.

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/6033a8db27e06f05. Report an issue: GitHub.