{"record":{"id":"c60c78e204c47377","repo":"apache/rocketmq","slug":"password-can-not-be-blank","errorCode":null,"errorMessage":"password can not be blank","messagePattern":"password can not be blank","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authentication/manager/AuthenticationMetadataManagerImpl.java","lineNumber":200,"sourceCode":"    @Override\n    public CompletableFuture<Boolean> isSuperUser(String username) {\n        return this.getUser(username).thenApply(user -> {\n            if (user == null) {\n                throw new AuthenticationException(\"User:{} is not found\", username);\n            }\n            return user.getUserType() == UserType.SUPER;\n        });\n    }\n\n    private void validate(User user, boolean isCreate) {\n        if (user == null) {\n            throw new AuthenticationException(\"user can not be null\");\n        }\n        if (StringUtils.isBlank(user.getUsername())) {\n            throw new AuthenticationException(\"username can not be blank\");\n        }\n        if (isCreate && StringUtils.isBlank(user.getPassword())) {\n            throw new AuthenticationException(\"password can not be blank\");\n        }\n    }\n\n    private void handleException(Exception e, CompletableFuture<?> result) {\n        Throwable throwable = ExceptionUtils.getRealException(e);\n        result.completeExceptionally(throwable);\n    }\n\n    private AuthenticationMetadataProvider getAuthenticationMetadataProvider() {\n        if (authenticationMetadataProvider == null) {\n            throw new IllegalStateException(\"The authenticationMetadataProvider is not configured.\");\n        }\n        return authenticationMetadataProvider;\n    }\n\n    private AuthorizationMetadataProvider getAuthorizationMetadataProvider() {\n        if (authorizationMetadataProvider == null) {\n            throw new IllegalStateException(\"The authorizationMetadataProvider is not configured.\");","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authentication/manager/AuthenticationMetadataManagerImpl.java#L182-L218","documentation":"The validator requires a non-blank password when isCreate is true, so createUser without a password is rejected. The password doubles as the HMAC secret for that user's signature verification, hence it cannot be empty at creation. updateUser is exempt because password changes are optional there.","triggerScenarios":"createUser with a User whose password is null, empty, or whitespace-only - commonly an admin API that forwards a request body where the password field was omitted (intending server-side generation).","commonSituations":"Creating users from forms/scripts where the password parameter was dropped; API clients assuming the server generates a default password; trimming logic that reduces the password to empty.","solutions":["Provide a non-blank password at creation: mqadmin createUser -u <user> -p <password>, or User.of(username, password).","If passwords come from a request DTO, mark the field required for create operations and validate before calling the manager.","For automated flows, generate a random secret client-side and pass it (the manager will not invent one)."],"exampleFix":"// before\nauthManager.createUser(User.builder().username(\"alice\").build()); // no password\n\n// after\nString initialSecret = RandomStringUtils.randomAlphanumeric(24);\nauthManager.createUser(User.builder().username(\"alice\").password(initialSecret).build());","handlingStrategy":"validation","validationCode":"// Create-path guard\nif (isCreate && StringUtils.isBlank(user.getPassword())) {\n    throw new IllegalArgumentException(\"password is required when creating a user\");\n}","typeGuard":"boolean isCreateValid(User u) { return u != null && isNotBlank(u.getUsername()) && isNotBlank(u.getPassword()); }","tryCatchPattern":"catch (AuthenticationException e) { if message contains \"password can not be blank\" -> collect as form-validation error and re-prompt; do not call createUser again without a password. }","preventionTips":["Mark password required on create forms/DTOs, optional on update","Generate random secrets programmatically for automated provisioning"],"tags":["rocketmq","user-management","password","validation"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}