apache/rocketmq · error · AuthorizationException

The source ip is empty.

Error message

The source ip is empty.

What it means

Thrown by AuthorizationMetadataManagerImpl.validate() while iterating environment.getSourceIps(): one entry in the policy's source IP whitelist is blank (null, empty, or whitespace-only). When an Environment block is present with a non-empty sourceIps list, every element must be a usable IP or CIDR string.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java:259

            throw new AuthorizationException("The resource is null.");
        }
        if (resource.getResourceType() == null) {
            throw new AuthorizationException("The resource type is null.");
        }
        if (resource.getResourcePattern() == null) {
            throw new AuthorizationException("The resource pattern is null.");
        }
        if (CollectionUtils.isEmpty(entry.getActions())) {
            throw new AuthorizationException("The actions is empty.");
        }
        if (entry.getActions().contains(Action.ANY)) {
            throw new AuthorizationException("The actions can not be Any.");
        }
        Environment environment = entry.getEnvironment();
        if (environment != null && CollectionUtils.isNotEmpty(environment.getSourceIps())) {
            for (String sourceIp : environment.getSourceIps()) {
                if (StringUtils.isBlank(sourceIp)) {
                    throw new AuthorizationException("The source ip is empty.");
                }
                if (!IPAddressUtils.isValidIPOrCidr(sourceIp)) {
                    throw new AuthorizationException("The source ip is invalid.");
                }
            }
        }
        if (entry.getDecision() == null) {
            throw new AuthorizationException("The decision is null or illegal.");
        }
    }

    private <T> CompletableFuture<T> handleException(Exception e) {
        CompletableFuture<T> result = new CompletableFuture<>();
        Throwable throwable = ExceptionUtils.getRealException(e);
        result.completeExceptionally(throwable);
        return result;
    }

View on GitHub (pinned to 293f588571)

Solutions

1. Remove blank entries from the sourceIps array in the ACL document
2. If generating from a comma-separated string, filter blanks before setting: Arrays.stream(raw.split(",")).map(String::trim).filter(s -> !s.isEmpty()).collect(toList())

Example fix

// before
Environment env = new Environment();
env.setSourceIps(Arrays.asList("192.168.1.0/24", ""));

// after
Environment env = new Environment();
env.setSourceIps(Arrays.asList("192.168.1.0/24"));

List<String> sanitize(List<String> ips) {
    return ips == null ? Collections.emptyList()
        : ips.stream().map(String::trim).filter(s -> !s.isEmpty()).collect(Collectors.toList());
}
env.setSourceIps(sanitize(rawIps));

try { metadataManager.createAcl(acl).join(); }
catch (AuthorizationException e) { /* log, sanitize sourceIps, resubmit */ }

When it happens

Trigger: createAcl/updateAcl with a policy whose environment.sourceIps contains "", " ", or an empty string produced by a trailing comma in a comma-separated split (e.g. "192.168.1.1,").

Common situations: Building sourceIps by splitting a config string that ends with a comma; templated ACL JSON that leaves an IP slot empty; copy-paste of a policy with a dangling list element.

Related errors

• The source ip is invalid.
• The actions is empty.
• The actions can not be Any.
• The decision is null or illegal.
• The body of acl is null

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/792e44c89c486167. Report an issue: GitHub.