apache/rocketmq · error · AuthenticationException

User:{} is not found.

Error message

User:{} is not found.

What it means

The metadata provider's getUser(username) completed with null, meaning no user record exists for the username extracted from the Credential pair. The server refuses to authenticate unknown users before any signature comparison. Distinct from 'username cannot be null': here the username was present but unresolvable.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authentication/chain/DefaultAuthenticationHandler.java:60

    @Override
    public CompletableFuture<Void> handle(DefaultAuthenticationContext context,
        HandlerChain<DefaultAuthenticationContext, CompletableFuture<Void>> chain) {
        return getUser(context).thenAccept(user -> doAuthenticate(context, user));
    }

    protected CompletableFuture<User> getUser(DefaultAuthenticationContext context) {
        if (this.authenticationMetadataProvider == null) {
            throw new AuthenticationException("The authenticationMetadataProvider is not configured");
        }
        if (StringUtils.isEmpty(context.getUsername())) {
            throw new AuthenticationException("username cannot be null.");
        }
        return this.authenticationMetadataProvider.getUser(context.getUsername());
    }

    protected void doAuthenticate(DefaultAuthenticationContext context, User user) {
        if (user == null) {
            throw new AuthenticationException("User:{} is not found.", context.getUsername());
        }
        if (user.getUserStatus() == UserStatus.DISABLE) {
            throw new AuthenticationException("User:{} is disabled.", context.getUsername());
        }
        String signature = AclSigner.calSignature(context.getContent(), user.getPassword());
        if (context.getSignature() == null
            || !MessageDigest.isEqual(signature.getBytes(AclSigner.DEFAULT_CHARSET), context.getSignature().getBytes(AclSigner.DEFAULT_CHARSET))) {
            throw new AuthenticationException("check signature failed.");
        }
    }
}

View on GitHub (pinned to 293f588571)

Solutions

1. Create the user on the broker: use the admin tool / mqadmin createUser or the User RPC (AuthenticationMetadataManager.createUser) with the same username and matching password.
2. Verify the exact username string (no whitespace/case differences) matches what the client sends in Credential=.
3. Confirm the server metadata store actually contains the user (listUser) and that the provider points at the intended database.

Example fix

// before: client uses a user that was never created
new StaticSessionCredentialsProvider("alice", "pw")

// after: provision first, then connect
// mqadmin.sh createUser -n <nameserver> -c <cluster> -u alice -p pw
new StaticSessionCredentialsProvider("alice", "pw")

// Provisioning check before first connect
authManager.getUser(username)
    .thenAccept(u -> { if (u == null) throw new IllegalStateException("user not provisioned: " + username); });

catch (AuthenticationException e) { if message contains "is not found" -> run user provisioning (createUser), then retry connection once; distinguish from signature failures. }

When it happens

Trigger: Client presents a username that was never created via createUser / the ACL user store (e.g. default 'rocketmq' user on a fresh broker with a custom auth backend), or the metadata store lookup silently returned null for a mistyped name.

Common situations: Fresh installation where users were not provisioned (no default super user created); username case mismatch or trailing whitespace; pointing the broker at an empty/wrong metadata database after a migration; user was deleted.

Related errors

• datetime is null.
• The user is not exist
• authentication header is incorrect.
• authentication keyValues length is incorrect, actual length=
• authentication credential length is incorrect, actual length

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/c016cda22b4a962d. Report an issue: GitHub.