apache/rocketmq · error · AuthenticationException

The super user can only be update by super user

Error message

The super user can only be update by super user

What it means

Update-user handler guard: if the user being updated (old record) has UserType.SUPER and the requester is not a super user, the chain throws AuthenticationException('The super user can only be update by super user'). Only super users may modify super-user accounts.

Source

Thrown at broker/src/main/java/org/apache/rocketmq/broker/processor/AdminBrokerProcessor.java:3299

        }

        UserInfo userInfo = RemotingSerializable.decode(request.getBody(), UserInfo.class);
        userInfo.setUsername(requestHeader.getUsername());
        User user = UserConverter.convertUser(userInfo);

        if (user.getUserType() == UserType.SUPER && isNotSuperUserLogin(request)) {
            response.setCode(ResponseCode.SYSTEM_ERROR);
            response.setRemark("The super user can only be update by super user");
            return response;
        }

        this.brokerController.getAuthenticationMetadataManager().getUser(requestHeader.getUsername())
            .thenCompose(old -> {
                if (old == null) {
                    throw new AuthenticationException("The user is not exist");
                }
                if (old.getUserType() == UserType.SUPER && isNotSuperUserLogin(request)) {
                    throw new AuthenticationException("The super user can only be update by super user");
                }
                return this.brokerController.getAuthenticationMetadataManager().updateUser(user);
            }).thenAccept(nil -> response.setCode(ResponseCode.SUCCESS))
            .exceptionally(ex -> {
                LOGGER.error("update user {} error", requestHeader.getUsername(), ex);
                return handleAuthException(response, ex);
            })
            .join();
        return response;
    }

    private RemotingCommand deleteUser(ChannelHandlerContext ctx,
        RemotingCommand request) throws RemotingCommandException {
        final RemotingCommand response = RemotingCommand.createResponseCommand(null);

        DeleteUserRequestHeader requestHeader = request.decodeCommandCustomHeader(DeleteUserRequestHeader.class);

        this.brokerController.getAuthenticationMetadataManager().getUser(requestHeader.getUsername())

View on GitHub (pinned to 293f588571)

Solutions

1. Authenticate the request with a super user's credentials (session/accessKey of an existing SUPER user).
2. If no super user is available, recover per docs: temporarily clear/disable ACL metadata (acl config file) on the broker to regain super access, then fix credentials.
3. Keep automated tooling that manages users on a dedicated super-user account.

Example fix

// before: default/normal accessKey used
mqadmin updateUser -n broker:10911 -u admin -p newPass
// -> AuthenticationException

// after: authenticate as super user
mqadmin updateUser -n broker:10911 -u admin -p newPass \
  -su <superAccessKey> -sp <superSecretKey>

// before sending UPDATE_USER for a SUPER target, confirm the session principal is SUPER
if (targetUser.getUserType() == UserType.SUPER && !session.isSuper()) {
    throw new SecurityException("use super-user credentials");
}

catch (CompletionException e) { if (e.getCause() instanceof AuthenticationException) { /* surface 401/403 to operator; do not retry with same creds */ } throw e; }

When it happens

Trigger: UPDATE_USER sent with credentials of a normal (non-super) user targeting a SUPER user account.

Common situations: Automation using a low-privilege access key to rotate the super user's password; token/accessKey of an ordinary user configured in tools (mqadmin) while editing the admin account.

Related errors

• The user is not exist
• The body of acl is null
• topic list is empty.
• topic config is null.
• subscription group is null.

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/dbf9c1ce4713a027. Report an issue: GitHub.