apache/rocketmq · error · AuthorizationException

The actions can not be Any.

Error message

The actions can not be Any.

What it means

Thrown by AuthorizationMetadataManagerImpl.validate() when a PolicyEntry's actions list contains Action.ANY. Although ANY exists in the Action enum, stored ACL policies must enumerate concrete actions; the wildcard is only meaningful at evaluation time, not in persisted policy definitions. This mirrors the sibling rule that resources must have a concrete pattern.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java:253

        }
    }

    private void validate(PolicyEntry entry) {
        Resource resource = entry.getResource();
        if (resource == null) {
            throw new AuthorizationException("The resource is null.");
        }
        if (resource.getResourceType() == null) {
            throw new AuthorizationException("The resource type is null.");
        }
        if (resource.getResourcePattern() == null) {
            throw new AuthorizationException("The resource pattern is null.");
        }
        if (CollectionUtils.isEmpty(entry.getActions())) {
            throw new AuthorizationException("The actions is empty.");
        }
        if (entry.getActions().contains(Action.ANY)) {
            throw new AuthorizationException("The actions can not be Any.");
        }
        Environment environment = entry.getEnvironment();
        if (environment != null && CollectionUtils.isNotEmpty(environment.getSourceIps())) {
            for (String sourceIp : environment.getSourceIps()) {
                if (StringUtils.isBlank(sourceIp)) {
                    throw new AuthorizationException("The source ip is empty.");
                }
                if (!IPAddressUtils.isValidIPOrCidr(sourceIp)) {
                    throw new AuthorizationException("The source ip is invalid.");
                }
            }
        }
        if (entry.getDecision() == null) {
            throw new AuthorizationException("The decision is null or illegal.");
        }
    }

    private <T> CompletableFuture<T> handleException(Exception e) {

View on GitHub (pinned to 293f588571)

Solutions

1. Replace ["ANY"] with the explicit list ["PUB","SUB"] (add other concrete actions if supported by the resource type)
2. If the intent is to allow everything for a subject, grant both PUB and SUB explicitly on the desired resource pattern

Example fix

// before
{ "subjects":[{"subjectType":"User","subjectKey":"alice"}],
  "policies":[{"resources":[{"type":"TOPIC","pattern":"*"}],"actions":["ANY"],"decision":"ALLOW"}] }

// after
{ "subjects":[{"subjectType":"User","subjectKey":"alice"}],
  "policies":[{"resources":[{"type":"TOPIC","pattern":"*"}],"actions":["PUB","SUB"],"decision":"ALLOW"}] }

boolean actionsAreConcrete(PolicyEntry entry) {
    return entry.getActions() != null && entry.getActions().stream().noneMatch(a -> a == Action.ANY);
}

try {
    metadataManager.updateAcl(acl).join();
} catch (AuthorizationException e) {
    if (e.getMessage().contains("Any")) { /* replace ANY with PUB,SUB and retry */ }
}

When it happens

Trigger: Creating or updating an ACL whose policy JSON contains "actions":["ANY"] (or Action.ANY added programmatically) via createAcl/updateAcl or the mqadmin acl update path.

Common situations: A user migrating from the legacy ACL schema (which allowed permissive wildcard-like entries) tries to express 'all actions' with ANY; tooling or AI-generated ACL JSON uses ANY intending full access.

Related errors

• The actions is empty.
• The source ip is empty.
• The source ip is invalid.
• The decision is null or illegal.
• The body of acl is null

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/308a2c4aa0648481. Report an issue: GitHub.