apache/rocketmq · error · AuthorizationException

The source ip is invalid.

Error message

The source ip is invalid.

What it means

Thrown by AuthorizationMetadataManagerImpl.validate() when a source IP entry in the policy's environment fails IPAddressUtils.isValidIPOrCidr(). Each sourceIps element must be a well-formed IPv4/IPv6 address or CIDR block (e.g. 192.168.1.10 or 10.0.0.0/8). Malformed tokens such as hostnames, partial CIDRs, or ranges are rejected.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java:262

            throw new AuthorizationException("The resource type is null.");
        }
        if (resource.getResourcePattern() == null) {
            throw new AuthorizationException("The resource pattern is null.");
        }
        if (CollectionUtils.isEmpty(entry.getActions())) {
            throw new AuthorizationException("The actions is empty.");
        }
        if (entry.getActions().contains(Action.ANY)) {
            throw new AuthorizationException("The actions can not be Any.");
        }
        Environment environment = entry.getEnvironment();
        if (environment != null && CollectionUtils.isNotEmpty(environment.getSourceIps())) {
            for (String sourceIp : environment.getSourceIps()) {
                if (StringUtils.isBlank(sourceIp)) {
                    throw new AuthorizationException("The source ip is empty.");
                }
                if (!IPAddressUtils.isValidIPOrCidr(sourceIp)) {
                    throw new AuthorizationException("The source ip is invalid.");
                }
            }
        }
        if (entry.getDecision() == null) {
            throw new AuthorizationException("The decision is null or illegal.");
        }
    }

    private <T> CompletableFuture<T> handleException(Exception e) {
        CompletableFuture<T> result = new CompletableFuture<>();
        Throwable throwable = ExceptionUtils.getRealException(e);
        result.completeExceptionally(throwable);
        return result;
    }

    private AuthenticationMetadataProvider getAuthenticationMetadataProvider() {
        if (authenticationMetadataProvider == null) {
            throw new IllegalStateException("The authenticationMetadataProvider is not configured.");

View on GitHub (pinned to 293f588571)

Solutions

1. Convert each entry to a valid single IP or CIDR block (replace ranges like 192.168.1.1-192.168.1.5 with the CIDR 192.168.1.0/24 or list the individual IPs)
2. Resolve hostnames to IPs before writing the policy — hostnames are not accepted
3. Double-check IPv6 formatting (e.g. 2001:db8::/32) and remove stray characters

Example fix

// before
env.setSourceIps(Arrays.asList("192.168.1.10-192.168.1.20"));

// after
env.setSourceIps(Arrays.asList("192.168.1.10", "192.168.1.20"));
// or express the whole range as CIDR: env.setSourceIps(Arrays.asList("192.168.1.0/24"));

boolean allValidIps(List<String> ips) {
    return ips.stream().allMatch(ip -> IPAddressUtils.isValidIPOrCidr(ip));
}
if (!allValidIps(env.getSourceIps())) throw new IllegalArgumentException("bad source ip");

try { metadataManager.createAcl(acl).join(); }
catch (AuthorizationException e) { /* surface which ip failed, fix format, resubmit */ }

When it happens

Trigger: createAcl/updateAcl where environment.sourceIps contains values like "my-host.example.com", "192.168.1", "10.0.0.0/8/24", or "192.168.1.1-192.168.1.5" (ranges are not supported, only single IPs and CIDR).

Common situations: Users assume IP ranges (start-end) are allowed; DNS hostnames are supplied instead of IPs; IPv6 addresses with wrong notation; stray units or whitespace-embedded text after trimming.

Related errors

• The source ip is empty.
• The actions is empty.
• The actions can not be Any.
• The decision is null or illegal.
• The body of acl is null

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/8e604713ccd9c3f8. Report an issue: GitHub.