{"record":{"id":"c016cda22b4a962d","repo":"apache/rocketmq","slug":"user-is-not-found","errorCode":null,"errorMessage":"User:{} is not found.","messagePattern":"User:(.+?) is not found\\.","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authentication/chain/DefaultAuthenticationHandler.java","lineNumber":60,"sourceCode":"    @Override\n    public CompletableFuture<Void> handle(DefaultAuthenticationContext context,\n        HandlerChain<DefaultAuthenticationContext, CompletableFuture<Void>> chain) {\n        return getUser(context).thenAccept(user -> doAuthenticate(context, user));\n    }\n\n    protected CompletableFuture<User> getUser(DefaultAuthenticationContext context) {\n        if (this.authenticationMetadataProvider == null) {\n            throw new AuthenticationException(\"The authenticationMetadataProvider is not configured\");\n        }\n        if (StringUtils.isEmpty(context.getUsername())) {\n            throw new AuthenticationException(\"username cannot be null.\");\n        }\n        return this.authenticationMetadataProvider.getUser(context.getUsername());\n    }\n\n    protected void doAuthenticate(DefaultAuthenticationContext context, User user) {\n        if (user == null) {\n            throw new AuthenticationException(\"User:{} is not found.\", context.getUsername());\n        }\n        if (user.getUserStatus() == UserStatus.DISABLE) {\n            throw new AuthenticationException(\"User:{} is disabled.\", context.getUsername());\n        }\n        String signature = AclSigner.calSignature(context.getContent(), user.getPassword());\n        if (context.getSignature() == null\n            || !MessageDigest.isEqual(signature.getBytes(AclSigner.DEFAULT_CHARSET), context.getSignature().getBytes(AclSigner.DEFAULT_CHARSET))) {\n            throw new AuthenticationException(\"check signature failed.\");\n        }\n    }\n}\n","sourceCodeStart":42,"sourceCodeEnd":72,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authentication/chain/DefaultAuthenticationHandler.java#L42-L72","documentation":"The metadata provider's getUser(username) completed with null, meaning no user record exists for the username extracted from the Credential pair. The server refuses to authenticate unknown users before any signature comparison. Distinct from 'username cannot be null': here the username was present but unresolvable.","triggerScenarios":"Client presents a username that was never created via createUser / the ACL user store (e.g. default 'rocketmq' user on a fresh broker with a custom auth backend), or the metadata store lookup silently returned null for a mistyped name.","commonSituations":"Fresh installation where users were not provisioned (no default super user created); username case mismatch or trailing whitespace; pointing the broker at an empty/wrong metadata database after a migration; user was deleted.","solutions":["Create the user on the broker: use the admin tool / mqadmin createUser or the User RPC (AuthenticationMetadataManager.createUser) with the same username and matching password.","Verify the exact username string (no whitespace/case differences) matches what the client sends in Credential=.","Confirm the server metadata store actually contains the user (listUser) and that the provider points at the intended database."],"exampleFix":"// before: client uses a user that was never created\nnew StaticSessionCredentialsProvider(\"alice\", \"pw\")\n\n// after: provision first, then connect\n// mqadmin.sh createUser -n <nameserver> -c <cluster> -u alice -p pw\nnew StaticSessionCredentialsProvider(\"alice\", \"pw\")","handlingStrategy":"validation","validationCode":"// Provisioning check before first connect\nauthManager.getUser(username)\n    .thenAccept(u -> { if (u == null) throw new IllegalStateException(\"user not provisioned: \" + username); });","typeGuard":null,"tryCatchPattern":"catch (AuthenticationException e) { if message contains \"is not found\" -> run user provisioning (createUser), then retry connection once; distinguish from signature failures. }","preventionTips":["Provision users as part of deployment, before clients connect","Use listUser in a startup readiness check for required service accounts"],"tags":["rocketmq","authentication","user-management","metadata"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}