apache/rocketmq · error · AuthorizationException

update Acl to RocksDB failed.

Error message

update Acl to RocksDB failed.

What it means

LocalAuthorizationMetadataProvider.updateAcl() wraps exceptions from overwriting an existing Acl entry in the local RocksDB store (put + flushWAL + cache invalidation). The cause chain distinguishes RocksDB I/O errors from JSON serialization failures of the new Acl content.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/provider/LocalAuthorizationMetadataProvider.java:117

            this.storage.flushWAL();
            this.aclCache.invalidate(subject.getSubjectKey());
        } catch (Exception e) {
            throw new AuthorizationException("delete Acl from RocksDB failed.", e);
        }
        return CompletableFuture.completedFuture(null);
    }

    @Override
    public CompletableFuture<Void> updateAcl(Acl acl) {
        try {
            Subject subject = acl.getSubject();
            byte[] keyBytes = subject.getSubjectKey().getBytes(StandardCharsets.UTF_8);
            byte[] valueBytes = JSON.toJSONBytes(acl);
            this.storage.put(AUTH_METADATA_COLUMN_FAMILY, keyBytes, keyBytes.length, valueBytes);
            this.storage.flushWAL();
            this.aclCache.invalidate(subject.getSubjectKey());
        } catch (Exception e) {
            throw new AuthorizationException("update Acl to RocksDB failed.", e);
        }
        return CompletableFuture.completedFuture(null);
    }

    @Override
    public CompletableFuture<Acl> getAcl(Subject subject) {
        Acl acl = aclCache.get(subject.getSubjectKey());
        if (acl == AclCacheLoader.EMPTY_ACL) {
            return CompletableFuture.completedFuture(null);
        }
        return CompletableFuture.completedFuture(acl);
    }

    @Override
    public CompletableFuture<List<Acl>> listAcl(String subjectFilter, String resourceFilter) {
        List<Acl> result = new ArrayList<>();
        CompletableFuture<List<Acl>> future = new CompletableFuture<>();
        try {

View on GitHub (pinned to 293f588571)

Solutions

1. Examine the nested cause for the underlying RocksDB or JSON serialization error
2. Free disk space on the auth config volume if flushWAL is failing
3. Ensure the updated Acl contains only schema-valid PolicyEntry objects (actions, decision, resource set)
4. Retry once the broker storage is confirmed healthy (startup complete, no store errors in logs)

try {
    provider.updateAcl(acl).join();
} catch (CompletionException e) {
    Throwable real = ExceptionUtils.getRealException(e);
    if (real.getCause() instanceof RocksDBException) { /* storage issue: check disk */ }
}

When it happens

Trigger: updateAcl with a store in a failed state, or an Acl whose policies contain objects fastjson cannot serialize; also triggered by disk-full during the WAL flush.

Common situations: Concurrent ACL updates while the broker is shutting down; full config disk; malformed policy objects (e.g. custom enum or circular references) breaking JSON.toJSONBytes.

Related errors

• create Acl to RocksDB failed.
• delete Acl from RocksDB failed.
• get Acl from RocksDB failed.
• The actions is empty.
• The actions can not be Any.

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/1cfc0a123650f8f3. Report an issue: GitHub.