{"record":{"id":"a9882d92236b9c49","repo":"apache/rocketmq","slug":"authorization-failed-please-verify-your-access-ri","errorCode":null,"errorMessage":"Authorization failed. Please verify your access rights and try again.","messagePattern":"Authorization failed\\. Please verify your access rights and try again\\.","errorType":"exception","errorClass":"AuthorizationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authorization/strategy/AbstractAuthorizationStrategy.java","lineNumber":72,"sourceCode":"        if (!this.authConfig.isAuthorizationEnabled()) {\n            return;\n        }\n        if (this.authorizationProvider == null) {\n            return;\n        }\n        if (this.authorizationWhiteSet.contains(context.getRpcCode())) {\n            return;\n        }\n        try {\n            this.authorizationProvider.authorize(context).join();\n        } catch (AuthorizationException ex) {\n            throw ex;\n        } catch (Throwable ex) {\n            Throwable exception = ExceptionUtils.getRealException(ex);\n            if (exception instanceof AuthorizationException) {\n                throw (AuthorizationException) exception;\n            }\n            throw new AuthorizationException(\"Authorization failed. Please verify your access rights and try again.\", exception);\n        }\n    }\n}\n","sourceCodeStart":54,"sourceCodeEnd":76,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authorization/strategy/AbstractAuthorizationStrategy.java#L54-L76","documentation":"AbstractAuthorizationStrategy.authorize() catches any Throwable from the authorization provider that is not already an AuthorizationException (after unwrapping via ExceptionUtils.getRealException) and rethrows it as a generic AuthorizationException with the message 'Authorization failed. Please verify your access rights and try again.' It means the authorization pipeline itself broke — metadata store errors, timeout, or unexpected runtime exceptions — rather than a clean deny decision.","triggerScenarios":"Any RPC request on a non-whitelisted code while the authorization provider throws a non-AuthorizationException: RocksDB ACL store failure inside LocalAuthorizationMetadataProvider, CompletableFuture completion errors, or NPEs in a custom AuthorizationProvider implementation.","commonSituations":"The ACL RocksDB store is locked/corrupt so lookups blow up mid-request; a custom authorization provider plugin throwing runtime exceptions; auth metadata service (e.g. remote backend) unreachable causing unexpected exception types.","solutions":["Read the server log for the wrapped cause — the real exception is logged/attached and tells whether it is storage, plugin, or network","If caused by the local RocksDB store, fix the store issue (lock contention, disk, corruption) per error 85/89 guidance","If a custom AuthorizationProvider is plugged in, make it throw AuthorizationException for expected failures instead of raw runtime exceptions","Temporarily verify the client credentials are valid to rule out an authentication-stage failure being surfaced here"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    // client side: any RPC while authorization enabled\n    producer.send(msg);\n} catch (MQClientException | RemotingException e) {\n    if (String.valueOf(e).contains(\"Authorization failed\")) {\n        // check broker logs; verify ACL/RPC access and credential configuration\n    }\n}","preventionTips":["Health-check the ACL metadata store at broker startup so broken stores fail fast before serving RPCs","In custom authorization providers, translate expected failures into AuthorizationException so clients see precise errors","Monitor broker logs for the unwrapped cause behind this generic message"],"tags":["auth","authorization","rpc","wrapper","rocketmq"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}