apache/rocketmq · error · AuthenticationException

The user is existed

Error message

The user is existed

What it means

Admin operation createUser was rejected because getUser(username) returned an existing record. Usernames are unique in the auth metadata, and creation is a check-then-create sequence inside the manager, so duplicates fail with this error.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authentication/manager/AuthenticationMetadataManagerImpl.java:105

                throw new AuthenticationException("Init inner client authentication credentials error", e);
            }
        }
    }

    @Override
    public CompletableFuture<Void> createUser(User user) {
        CompletableFuture<Void> result = new CompletableFuture<>();
        try {
            this.validate(user, true);
            if (user.getUserType() == null) {
                user.setUserType(UserType.NORMAL);
            }
            if (user.getUserStatus() == null) {
                user.setUserStatus(UserStatus.ENABLE);
            }
            result = this.getAuthenticationMetadataProvider().getUser(user.getUsername()).thenCompose(old -> {
                if (old != null) {
                    throw new AuthenticationException("The user is existed");
                }
                return this.getAuthenticationMetadataProvider().createUser(user);
            });
        } catch (Exception e) {
            this.handleException(e, result);
        }
        return result;
    }

    @Override
    public CompletableFuture<Void> updateUser(User user) {
        CompletableFuture<Void> result = new CompletableFuture<>();
        try {
            this.validate(user, false);
            result = this.getAuthenticationMetadataProvider().getUser(user.getUsername()).thenCompose(old -> {
                if (old == null) {
                    throw new AuthenticationException("The user is not exist");
                }

View on GitHub (pinned to 293f588571)

Solutions

  1. If the intent is to change the user, call updateUser instead of createUser.
  2. Delete the existing user first (deleteUser) if it is truly stale, then re-create.
  3. Make provisioning scripts check getUser() before createUser (or treat this error as success for idempotent bootstrapping).

Example fix

// before
authManager.createUser(User.of("alice", "pw").toBuilder().userType(UserType.SUPER).build()); // throws if exists

// after
authManager.getUser("alice")
    .thenCompose(existing -> existing != null
        ? authManager.updateUser(User.of("alice", "newPw").toBuilder().userType(UserType.SUPER).build())
        : authManager.createUser(User.of("alice", "pw").toBuilder().userType(UserType.SUPER).build()));
Defensive patterns

Strategy: try-catch

Validate before calling

// Idempotent provisioning: check before create
authManager.getUser(user.getUsername())
    .thenCompose(existing -> existing != null
        ? CompletableFuture.completedFuture(null)
        : authManager.createUser(user));

Try / catch

catch (AuthenticationException e) { if message contains "user is existed" -> treat create as already-done (idempotent success) or switch to updateUser; never crash the provisioning script. }

Prevention

When it happens

Trigger: Calling the createUser RPC / mqadmin createUser for a username that already exists in the metadata provider's store, including a soft-deleted or default account still present.

Common situations: Re-running a provisioning script that is not idempotent; creating the default super user after initialization already created it; retrying a partially succeeded creation.

Related errors

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/1964498c26f59a6a. Report an issue: GitHub.