{"record":{"id":"2763aea9d32d2201","repo":"apache/pulsar","slug":"failed-to-get-permissions","errorCode":null,"errorMessage":"Failed to get permissions","messagePattern":"Failed to get permissions","errorType":"http","errorClass":"RestException","httpStatus":500,"severity":"error","filePath":"pulsar-broker/src/main/java/org/apache/pulsar/broker/rest/TopicsBase.java","lineNumber":718,"sourceCode":"            boolean isAuthorized;\n            try {\n                isAuthorized = pulsar().getBrokerService().getAuthorizationService()\n                        .allowTopicOperationAsync(topicName, TopicOperation.PRODUCE, authParams)\n                        .get(config().getMetadataStoreOperationTimeoutSeconds(), SECONDS);\n            } catch (TimeoutException e) {\n                log.warn()\n                        .attr(\"timeoutSec\", config().getMetadataStoreOperationTimeoutSeconds())\n                        .attr(\"topic\", topicName)\n                        .log(\"Timeout while checking authorization\");\n                throw new RestException(Status.INTERNAL_SERVER_ERROR, \"Time-out while checking authorization\");\n            } catch (Exception e) {\n                log.warn()\n                        .attr(\"role\", authParams.getClientRole())\n                        .attr(\"originalPrincipal\", authParams.getOriginalPrincipal())\n                        .attr(\"topic\", topicName)\n                        .exceptionMessage(e)\n                        .log(\"Producer-client with Role - failed to get permissions for topic - .\");\n                throw new RestException(Status.INTERNAL_SERVER_ERROR, \"Failed to get permissions\");\n            }\n\n            if (!isAuthorized) {\n                throw new RestException(Status.UNAUTHORIZED, \"Unauthorized to produce to topic \" + topicName);\n            }\n        }\n    }\n\n}\n","sourceCodeStart":700,"sourceCodeEnd":728,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker/src/main/java/org/apache/pulsar/broker/rest/TopicsBase.java#L700-L728","documentation":"If the authorization check itself fails (non-timeout Exception) inside validateProducePermission, the broker logs the role/topic details and throws RestException 500 'Failed to get permissions'. The client's authorization status is unknown, so the request is failed rather than silently allowed or denied.","triggerScenarios":"allowTopicOperationAsync completes exceptionally — e.g. authorization provider throwing while loading permissions from the metadata store, deserialization failures of policy data, or provider bugs.","commonSituations":"Corrupt/oversized permissions data in the store; custom AuthorizationProvider exceptions; policy data format changes after broker upgrade.","solutions":["Inspect broker logs for the logged role/topic and underlying exception (exceptionMessage attr)","Verify the AuthorizationProvider implementation and its configured backends","Check permissions data integrity for the topic/namespace in the metadata store","Retry the request; if persistent, fix or roll back the authorization provider/policy data"],"exampleFix":"// no client code fix; server-side: check provider\n// after: wrap custom provider logic defensively\nreturn authorizationProvider.canAccessAsync(...)\n    .exceptionally(ex -> { log.error(\"authz failed\", ex); return false; });","handlingStrategy":"retry","validationCode":"// no reliable client pre-check; server-side authz failure. Validate role/permissions exist:\n// GET /admin/v2/namespaces/{ns}/permissions returns 200 before producing","typeGuard":null,"tryCatchPattern":"try {\n    produceViaRest(topic, payload);\n} catch (RestException e) {\n    if (e.getResponse().getStatus() == 500 && e.getMessage().contains(\"Failed to get permissions\")) {\n        // retry with backoff; escalate if persistent (provider/store issue)\n        backoffAndRetry(topic, payload, 2);\n    } else throw e;\n}","preventionTips":["Keep AuthorizationProvider implementations robust (no unhandled throws)","Validate policy data integrity after broker upgrades","Monitor broker logs for repeated 'failed to get permissions' warnings"],"tags":["pulsar","rest-api","authorization","internal-error"],"backgroundTag":"authorization-check-failed","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}