{"record":{"id":"8d961afdc32300b4","repo":"apache/rocketmq","slug":"user-is-disabled","errorCode":null,"errorMessage":"User:{} is disabled.","messagePattern":"User:(.+?) is disabled\\.","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authentication/chain/DefaultAuthenticationHandler.java","lineNumber":63,"sourceCode":"        return getUser(context).thenAccept(user -> doAuthenticate(context, user));\n    }\n\n    protected CompletableFuture<User> getUser(DefaultAuthenticationContext context) {\n        if (this.authenticationMetadataProvider == null) {\n            throw new AuthenticationException(\"The authenticationMetadataProvider is not configured\");\n        }\n        if (StringUtils.isEmpty(context.getUsername())) {\n            throw new AuthenticationException(\"username cannot be null.\");\n        }\n        return this.authenticationMetadataProvider.getUser(context.getUsername());\n    }\n\n    protected void doAuthenticate(DefaultAuthenticationContext context, User user) {\n        if (user == null) {\n            throw new AuthenticationException(\"User:{} is not found.\", context.getUsername());\n        }\n        if (user.getUserStatus() == UserStatus.DISABLE) {\n            throw new AuthenticationException(\"User:{} is disabled.\", context.getUsername());\n        }\n        String signature = AclSigner.calSignature(context.getContent(), user.getPassword());\n        if (context.getSignature() == null\n            || !MessageDigest.isEqual(signature.getBytes(AclSigner.DEFAULT_CHARSET), context.getSignature().getBytes(AclSigner.DEFAULT_CHARSET))) {\n            throw new AuthenticationException(\"check signature failed.\");\n        }\n    }\n}\n","sourceCodeStart":45,"sourceCodeEnd":72,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authentication/chain/DefaultAuthenticationHandler.java#L45-L72","documentation":"The user record was found, but its userStatus is UserStatus.DISABLE, so authentication is rejected even before signature verification. This is an account-state failure controlled by server-side user administration, not by credentials correctness.","triggerScenarios":"An administrator disabled the account (updateUser with userStatus=DISABLE, or mqadmin updateUser -s DISABLE); all subsequent requests from that user fail with this error.","commonSituations":"Disabling a compromised or departed employee's account; bulk user management accidentally disabling the app's service account; testing lockout behavior.","solutions":["Re-enable the account: call updateUser with userStatus=ENABLE (mqadmin updateUser -s ENABLE -u <user>) or use a different, active account.","Audit why the account was disabled (admin action vs. automated policy) before re-enabling.","For service accounts, alert on DISABLE status so applications fail fast with a clear cause instead of recurring auth errors."],"exampleFix":"// before\nmqadmin updateUser -n <ns> -u alice -s DISABLE  // account locked out\n\n// after\nmqadmin updateUser -n <ns> -u alice -s ENABLE   // restored","handlingStrategy":"try-catch","validationCode":"// Before connecting, verify account state if you have admin access\nauthManager.getUser(username).thenAccept(u -> {\n    if (u != null && u.getUserStatus() == UserStatus.DISABLE) {\n        throw new IllegalStateException(\"account is disabled: \" + username);\n    }\n});","typeGuard":null,"tryCatchPattern":"catch (AuthenticationException e) { if message contains \"is disabled\" -> alert operations and stop retrying; re-enablement is an admin action, not a client one. }","preventionTips":["Monitor user status for service accounts","Automate re-enable + secret rotation as one runbook step"],"tags":["rocketmq","authentication","user-status","administration"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}