apache/rocketmq · error · AuthorizationException

unknown resource type.

Error message

unknown resource type.

What it means

DefaultAuthorizationContextBuilder.newSubContexts(Metadata, ResourceType, Resource) only knows how to build SUB contexts for GROUP and TOPIC resources. If the ResourceType of the incoming resource is anything else (or null), there is no code path to build an authorization context, so it throws to fail closed rather than authorize an unknown shape.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/builder/DefaultAuthorizationContextBuilder.java:815

        apache.rocketmq.v2.Resource resource) {
        return newSubContexts(metadata, ResourceType.GROUP, resource);
    }

    private static List<DefaultAuthorizationContext> newSubContexts(Metadata metadata, ResourceType resourceType,
        apache.rocketmq.v2.Resource resource) {
        if (resourceType == ResourceType.GROUP) {
            if (resource == null || StringUtils.isBlank(resource.getName())) {
                throw new AuthorizationException("group is null.");
            }
            return newSubContexts(metadata, Resource.ofGroup(resource.getName()));
        }
        if (resourceType == ResourceType.TOPIC) {
            if (resource == null || StringUtils.isBlank(resource.getName())) {
                throw new AuthorizationException("topic is null.");
            }
            return newSubContexts(metadata, Resource.ofTopic(resource.getName()));
        }
        throw new AuthorizationException("unknown resource type.");
    }

    private static List<DefaultAuthorizationContext> newSubContexts(Metadata metadata, Resource resource) {
        List<DefaultAuthorizationContext> result = new ArrayList<>();
        Subject subject = null;
        if (metadata.containsKey(GrpcConstants.AUTHORIZATION_AK)) {
            subject = User.of(metadata.get(GrpcConstants.AUTHORIZATION_AK));
        }
        String sourceIp = StringUtils.substringBeforeLast(metadata.get(GrpcConstants.REMOTE_ADDRESS), CommonConstants.COLON);
        result.add(DefaultAuthorizationContext.of(subject, resource, Action.SUB, sourceIp));
        return result;
    }
}

View on GitHub (pinned to 293f588571)

Solutions

1. Align versions: run proxy, broker, and auth modules from the same RocketMQ release (all 5.x.y identical).
2. If you maintain custom mapping code, ensure ResourceType is never null/unknown when converting apache.rocketmq.v2 resources to internal resources.
3. Check for a custom or shaded org.apache.rocketmq.auth builder on the classpath that predates the current enum; remove it.
4. Report upstream if a stock, same-version deployment reproduces it — the builder legitimately lacks a case for the new type.

Example fix

// before (custom mapping drops the type)
Resource res = Resource.of(resourceProto.getName()); // resourceType left null

// after
Resource res = Resource.of(
    resourceProto.getName(),
    ResourcePattern.LITERAL);
res.setResourceType(mapType(resourceProto)); // never null for GROUP/TOPIC paths

// Guard before building auth contexts
if (resourceType != ResourceType.GROUP && resourceType != ResourceType.TOPIC) {
    throw new IllegalArgumentException(
        "Unsupported resource type for SUB context: " + resourceType);
}

boolean isSubContextType(ResourceType t) {
    return t == ResourceType.GROUP || t == ResourceType.TOPIC;
}

When it happens

Trigger: A request reaches this builder with a ResourceType other than GROUP or TOPIC — e.g. a new ResourceType enum constant added by a newer server but handled by older auth code (version skew between broker/proxy modules), or a null ResourceType after a bad conversion from the protobuf layer.

Common situations: Mixed-version RocketMQ 5.x deployment (proxy newer than auth jar or vice versa); custom code that maps protobuf resources to the internal model and forgets to translate the type; future enum values (e.g. new resource kinds) reaching an older builder.

Related errors

• topic list is empty.
• cold data flow config is empty.
• subscription group list is empty.
• topic is null.
• The actions is empty.

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/cb10c3471ab4c9bf. Report an issue: GitHub.