apache/rocketmq · error · AuthenticationException

User:{} is disabled.

Error message

User:{} is disabled.

What it means

The user record was found, but its userStatus is UserStatus.DISABLE, so authentication is rejected even before signature verification. This is an account-state failure controlled by server-side user administration, not by credentials correctness.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authentication/chain/DefaultAuthenticationHandler.java:63

        return getUser(context).thenAccept(user -> doAuthenticate(context, user));
    }

    protected CompletableFuture<User> getUser(DefaultAuthenticationContext context) {
        if (this.authenticationMetadataProvider == null) {
            throw new AuthenticationException("The authenticationMetadataProvider is not configured");
        }
        if (StringUtils.isEmpty(context.getUsername())) {
            throw new AuthenticationException("username cannot be null.");
        }
        return this.authenticationMetadataProvider.getUser(context.getUsername());
    }

    protected void doAuthenticate(DefaultAuthenticationContext context, User user) {
        if (user == null) {
            throw new AuthenticationException("User:{} is not found.", context.getUsername());
        }
        if (user.getUserStatus() == UserStatus.DISABLE) {
            throw new AuthenticationException("User:{} is disabled.", context.getUsername());
        }
        String signature = AclSigner.calSignature(context.getContent(), user.getPassword());
        if (context.getSignature() == null
            || !MessageDigest.isEqual(signature.getBytes(AclSigner.DEFAULT_CHARSET), context.getSignature().getBytes(AclSigner.DEFAULT_CHARSET))) {
            throw new AuthenticationException("check signature failed.");
        }
    }
}

View on GitHub (pinned to 293f588571)

Solutions

1. Re-enable the account: call updateUser with userStatus=ENABLE (mqadmin updateUser -s ENABLE -u <user>) or use a different, active account.
2. Audit why the account was disabled (admin action vs. automated policy) before re-enabling.
3. For service accounts, alert on DISABLE status so applications fail fast with a clear cause instead of recurring auth errors.

Example fix

// before
mqadmin updateUser -n <ns> -u alice -s DISABLE  // account locked out

// after
mqadmin updateUser -n <ns> -u alice -s ENABLE   // restored

// Before connecting, verify account state if you have admin access
authManager.getUser(username).thenAccept(u -> {
    if (u != null && u.getUserStatus() == UserStatus.DISABLE) {
        throw new IllegalStateException("account is disabled: " + username);
    }
});

catch (AuthenticationException e) { if message contains "is disabled" -> alert operations and stop retrying; re-enablement is an admin action, not a client one. }

When it happens

Trigger: An administrator disabled the account (updateUser with userStatus=DISABLE, or mqadmin updateUser -s DISABLE); all subsequent requests from that user fail with this error.

Common situations: Disabling a compromised or departed employee's account; bulk user management accidentally disabling the app's service account; testing lockout behavior.

Related errors

• datetime is null.
• authentication header is incorrect.
• authentication keyValues length is incorrect, actual length=
• authentication credential length is incorrect, actual length
• create authentication context error.

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/8d961afdc32300b4. Report an issue: GitHub.