apache/rocketmq · error · AuthorizationException

The actions is empty.

Error message

The actions is empty.

What it means

Thrown by AuthorizationMetadataManagerImpl.validate() when a PolicyEntry submitted through createAcl/updateAcl has a null or empty actions collection. Every ACL policy in RocketMQ's new auth model must explicitly declare which actions (PUB, SUB, or both) it grants or denies. The check runs before the policy is persisted, so nothing is written to the metadata store.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java:250

        }
        for (PolicyEntry policyEntry : policyEntries) {
            this.validate(policyEntry);
        }
    }

    private void validate(PolicyEntry entry) {
        Resource resource = entry.getResource();
        if (resource == null) {
            throw new AuthorizationException("The resource is null.");
        }
        if (resource.getResourceType() == null) {
            throw new AuthorizationException("The resource type is null.");
        }
        if (resource.getResourcePattern() == null) {
            throw new AuthorizationException("The resource pattern is null.");
        }
        if (CollectionUtils.isEmpty(entry.getActions())) {
            throw new AuthorizationException("The actions is empty.");
        }
        if (entry.getActions().contains(Action.ANY)) {
            throw new AuthorizationException("The actions can not be Any.");
        }
        Environment environment = entry.getEnvironment();
        if (environment != null && CollectionUtils.isNotEmpty(environment.getSourceIps())) {
            for (String sourceIp : environment.getSourceIps()) {
                if (StringUtils.isBlank(sourceIp)) {
                    throw new AuthorizationException("The source ip is empty.");
                }
                if (!IPAddressUtils.isValidIPOrCidr(sourceIp)) {
                    throw new AuthorizationException("The source ip is invalid.");
                }
            }
        }
        if (entry.getDecision() == null) {
            throw new AuthorizationException("The decision is null or illegal.");
        }

View on GitHub (pinned to 293f588571)

Solutions

  1. Add an explicit actions array (e.g. ["PUB","SUB"]) to the policy entry being created or updated
  2. If building PolicyEntry in Java, call entry.setActions(Arrays.asList(Action.PUB, Action.SUB)) before submit
  3. Validate the ACL document against the current PolicyEntry schema (check for typos like "action" instead of "actions" that would silently deserialize to null)

Example fix

// before
PolicyEntry entry = new PolicyEntry();
entry.setResource(Resource.of(ResourceType.TOPIC, "T"));
entry.setDecision(Decision.ALLOW);
metadataManager.createAcl(new Acl(Subject.of("User", "alice"), Collections.singletonList(entry)));

// after
PolicyEntry entry = new PolicyEntry();
entry.setResource(Resource.of(ResourceType.TOPIC, "T"));
entry.setActions(Arrays.asList(Action.PUB, Action.SUB));
entry.setDecision(Decision.ALLOW);
metadataManager.createAcl(new Acl(Subject.of("User", "alice"), Collections.singletonList(entry)));
Defensive patterns

Strategy: validation

Validate before calling

boolean hasActions(PolicyEntry entry) {
    return entry != null && entry.getActions() != null && !entry.getActions().isEmpty();
}
// before metadataManager.createAcl(acl):
for (PolicyEntry e : acl.getPolicies()) {
    if (!hasActions(e)) throw new IllegalArgumentException("policy missing actions");
}

Try / catch

try {
    metadataManager.createAcl(acl).join();
} catch (CompletionException | AuthorizationException e) {
    // validate message, fix the ACL document, resubmit
}

Prevention

When it happens

Trigger: Calling AuthorizationMetadataManager.createAcl(...) or updateAcl(...) (or the corresponding mqadmin/ACL update command) with a PolicyEntry whose actions field is null or an empty list, e.g. a JSON ACL document that omits the "actions" array.

Common situations: Hand-written ACL policy JSON where the actions key was forgotten; a management UI or script that builds PolicyEntry objects programmatically and never sets actions; deserialization of a policy document from an older schema that used a different field name.

Related errors

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/c018fad6d20cf8a4. Report an issue: GitHub.