{"record":{"id":"7f10ed4eccde1baa","repo":"apache/rocketmq","slug":"user-is-not-found-7f10ed","errorCode":null,"errorMessage":"User:{} is not found","messagePattern":"User:(.+?) is not found","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authentication/manager/AuthenticationMetadataManagerImpl.java","lineNumber":186,"sourceCode":"        return result;\n    }\n\n    @Override\n    public CompletableFuture<List<User>> listUser(String filter) {\n        CompletableFuture<List<User>> result = new CompletableFuture<>();\n        try {\n            result = this.getAuthenticationMetadataProvider().listUser(filter);\n        } catch (Exception e) {\n            this.handleException(e, result);\n        }\n        return result;\n    }\n\n    @Override\n    public CompletableFuture<Boolean> isSuperUser(String username) {\n        return this.getUser(username).thenApply(user -> {\n            if (user == null) {\n                throw new AuthenticationException(\"User:{} is not found\", username);\n            }\n            return user.getUserType() == UserType.SUPER;\n        });\n    }\n\n    private void validate(User user, boolean isCreate) {\n        if (user == null) {\n            throw new AuthenticationException(\"user can not be null\");\n        }\n        if (StringUtils.isBlank(user.getUsername())) {\n            throw new AuthenticationException(\"username can not be blank\");\n        }\n        if (isCreate && StringUtils.isBlank(user.getPassword())) {\n            throw new AuthenticationException(\"password can not be blank\");\n        }\n    }\n\n    private void handleException(Exception e, CompletableFuture<?> result) {","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authentication/manager/AuthenticationMetadataManagerImpl.java#L168-L204","documentation":"isSuperUser(username) chains getUser and rejects when the lookup yields null: the authorization check cannot decide super-user status for an unknown account, so it fails closed with AuthenticationException instead of returning false.","triggerScenarios":"Calling isSuperUser for a user that was never created or has been deleted - commonly on the server's internal authorization path (e.g. evaluating an ACL that requires SUPER type) with a username that is not in the metadata store.","commonSituations":"ACL evaluations after a user was deleted but connections/sessions still active; misconfigured ACL rules referencing unknown users; health or admin checks probing usernames that do not exist.","solutions":["Create the referenced user in the metadata store, or remove/fix ACL entries and calls that reference it.","Treat a missing user as non-super defensively at the call site: catch the AuthenticationException (or pre-check getUser) and return false when appropriate.","Keep user deletion coordinated with ACL cleanup so authorization never sees dangling usernames."],"exampleFix":"// before\nboolean sup = authManager.isSuperUser(username).join(); // throws for unknown user\n\n// after\nboolean sup = authManager.getUser(username)\n    .thenApply(u -> u != null && u.getUserType() == UserType.SUPER)\n    .exceptionally(e -> false)\n    .join();","handlingStrategy":"fallback","validationCode":"// Pre-check existence before deciding super-user status\nauthManager.getUser(username)\n    .thenApply(u -> u != null && u.getUserType() == UserType.SUPER);","typeGuard":null,"tryCatchPattern":"catch (AuthenticationException | CompletionException e) { if cause message contains \"is not found\" -> default to false (deny) and log the dangling username for ACL cleanup. }","preventionTips":["Treat missing users as 'not super' (fail closed to deny) in authorization callers","Keep user deletion and ACL rule cleanup in one transaction/runbook step"],"tags":["rocketmq","authorization","super-user","not-found"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}