{"record":{"id":"4dbe640ba354aa42","repo":"apache/rocketmq","slug":"the-authenticationmetadataprovider-is-not-configur","errorCode":null,"errorMessage":"The authenticationMetadataProvider is not configured","messagePattern":"The authenticationMetadataProvider is not configured","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"critical","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authentication/chain/DefaultAuthenticationHandler.java","lineNumber":50,"sourceCode":"import org.apache.rocketmq.common.chain.HandlerChain;\n\npublic class DefaultAuthenticationHandler implements Handler<DefaultAuthenticationContext, CompletableFuture<Void>> {\n\n    private final AuthenticationMetadataProvider authenticationMetadataProvider;\n\n    public DefaultAuthenticationHandler(AuthConfig config, Supplier<?> metadataService) {\n        this.authenticationMetadataProvider = AuthenticationFactory.getMetadataProvider(config, metadataService);\n    }\n\n    @Override\n    public CompletableFuture<Void> handle(DefaultAuthenticationContext context,\n        HandlerChain<DefaultAuthenticationContext, CompletableFuture<Void>> chain) {\n        return getUser(context).thenAccept(user -> doAuthenticate(context, user));\n    }\n\n    protected CompletableFuture<User> getUser(DefaultAuthenticationContext context) {\n        if (this.authenticationMetadataProvider == null) {\n            throw new AuthenticationException(\"The authenticationMetadataProvider is not configured\");\n        }\n        if (StringUtils.isEmpty(context.getUsername())) {\n            throw new AuthenticationException(\"username cannot be null.\");\n        }\n        return this.authenticationMetadataProvider.getUser(context.getUsername());\n    }\n\n    protected void doAuthenticate(DefaultAuthenticationContext context, User user) {\n        if (user == null) {\n            throw new AuthenticationException(\"User:{} is not found.\", context.getUsername());\n        }\n        if (user.getUserStatus() == UserStatus.DISABLE) {\n            throw new AuthenticationException(\"User:{} is disabled.\", context.getUsername());\n        }\n        String signature = AclSigner.calSignature(context.getContent(), user.getPassword());\n        if (context.getSignature() == null\n            || !MessageDigest.isEqual(signature.getBytes(AclSigner.DEFAULT_CHARSET), context.getSignature().getBytes(AclSigner.DEFAULT_CHARSET))) {\n            throw new AuthenticationException(\"check signature failed.\");","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authentication/chain/DefaultAuthenticationHandler.java#L32-L68","documentation":"DefaultAuthenticationHandler was constructed but AuthenticationFactory.getMetadataProvider(config, metadataService) returned null, so there is no backend to look up users. The handler explicitly refuses to authenticate without a metadata provider rather than failing open. This is a server-side wiring/configuration error, not a client error.","triggerScenarios":"Broker/proxy starts with authentication enabled (e.g. authenticationEnabled=true) but the configured metadata provider class cannot be instantiated - wrong className in config, missing auth implementation jar on the classpath, or metadataService supplier incompatible with the provider constructor.","commonSituations":"auth module version mismatch where the configured authMetadataProvider classname does not exist; deploying the distribution without the auth jar; typos in the provider config key; upgrading RocketMQ and the provider class moved packages.","solutions":["Check broker/proxy logs at startup: this usually surfaces the underlying reason getMetadataProvider returned null (ClassNotFound / instantiation failure).","Correct the auth configuration so the metadata provider is resolvable, e.g. set authenticationMetadataProvider to the shipped implementation (org.apache.rocketmq.auth.metadata.manager.AuthenticationMetadataManagerImpl or the declared provider class) and ensure its required datastore (radius/jute KV or database) is reachable.","Ensure the auth jar and its dependencies are on the server classpath and versions match the broker."],"exampleFix":"// before (broker.conf)\nauthenticationEnabled=true\n# no authenticationMetadataProvider configured\n\n// after (broker.conf)\nauthenticationEnabled=true\nauthenticationMetadataProvider=org.apache.rocketmq.auth.metadata.manager.AuthenticationMetadataManagerImpl\nauthConfig=... # datastore config the provider needs","handlingStrategy":"validation","validationCode":"// Server-side startup self-check (broker/proxy bootstrap)\nif (authConfig.isAuthenticationEnabled()) {\n    AuthenticationHandler handler = AuthenticationFactory.getAuthenticationHandler(authConfig, metadataService);\n    // constructing/invoking it at startup surfaces provider misconfig immediately\n}","typeGuard":null,"tryCatchPattern":"This is server-side and non-retryable: catch at broker startup, log the underlying provider-resolution failure, and refuse to start with auth enabled.","preventionTips":["Smoke-test an authenticated RPC right after broker startup in CI","Pin auth module and broker versions together; verify provider classnames after upgrades"],"tags":["rocketmq","authentication","configuration","server"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}