apache/rocketmq · critical · IllegalStateException

The authorizationMetadataProvider is not configured.

Error message

The authorizationMetadataProvider is not configured.

What it means

IllegalStateException from the manager's second lazy accessor: the AuthorizationMetadataProvider is null, so operations that touch ACL data fail. It is reached by deleteUser (which cascades deleteAcl for the user) even though the class is the authentication manager - the delete path requires both providers.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authentication/manager/AuthenticationMetadataManagerImpl.java:218

            throw new AuthenticationException("password can not be blank");
        }
    }

    private void handleException(Exception e, CompletableFuture<?> result) {
        Throwable throwable = ExceptionUtils.getRealException(e);
        result.completeExceptionally(throwable);
    }

    private AuthenticationMetadataProvider getAuthenticationMetadataProvider() {
        if (authenticationMetadataProvider == null) {
            throw new IllegalStateException("The authenticationMetadataProvider is not configured.");
        }
        return authenticationMetadataProvider;
    }

    private AuthorizationMetadataProvider getAuthorizationMetadataProvider() {
        if (authorizationMetadataProvider == null) {
            throw new IllegalStateException("The authorizationMetadataProvider is not configured.");
        }
        return authorizationMetadataProvider;
    }
}

View on GitHub (pinned to 293f588571)

Solutions

Initialize both providers - use the standard AuthenticationFactory/broker wiring which configures authentication and authorization metadata providers together.
If embedding manually, supply a non-null AuthorizationMetadataProvider (they are usually the same underlying manager implementation backed by one store).
Add a startup self-check covering the delete path (not just reads) to catch the missing provider early.

Example fix

// before
// manager initialized with authentication provider only
manager.deleteUser("alice"); // IllegalStateException from getAuthorizationMetadataProvider

// after
// initialize via factory so both providers are set
AuthenticationMetadataManager manager = AuthenticationFactory.getMetadataManager(authConfig, metadataService);
manager.deleteUser("alice");

Defensive patterns

Strategy: validation

Validate before calling

// Startup self-check covering the delete path (needs BOTH providers)
authManager.getUser("__probe__").thenApply(u -> {
    // read path OK; now ensure ACL provider is wired by exercising a cheap authorization-side op
    return authManager.listAcl(null);
}).join();

Try / catch

catch (IllegalStateException e) { if message contains "authorizationMetadataProvider is not configured" -> fix wiring and restart; runtime retry is pointless. }

Prevention

Configure authentication and authorization metadata providers together from one AuthConfig
Test deleteUser in integration CI - it is the path that needs both providers

When it happens

Trigger: deleteUser on a manager initialized without an AuthorizationMetadataProvider; any current or future method calling getAuthorizationMetadataProvider() (currently deleteUser's deleteAcl cascade).

Common situations: Same wiring causes as error 18: factory/embedding setups that only supply the authentication provider; partial test doubles; config that names only one provider.

Related errors

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/777ae335f19272cc. Report an issue: GitHub.