{"record":{"id":"dbf9c1ce4713a027","repo":"apache/rocketmq","slug":"the-super-user-can-only-be-update-by-super-user","errorCode":null,"errorMessage":"The super user can only be update by super user","messagePattern":"The super user can only be update by super user","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"broker/src/main/java/org/apache/rocketmq/broker/processor/AdminBrokerProcessor.java","lineNumber":3299,"sourceCode":"        }\n\n        UserInfo userInfo = RemotingSerializable.decode(request.getBody(), UserInfo.class);\n        userInfo.setUsername(requestHeader.getUsername());\n        User user = UserConverter.convertUser(userInfo);\n\n        if (user.getUserType() == UserType.SUPER && isNotSuperUserLogin(request)) {\n            response.setCode(ResponseCode.SYSTEM_ERROR);\n            response.setRemark(\"The super user can only be update by super user\");\n            return response;\n        }\n\n        this.brokerController.getAuthenticationMetadataManager().getUser(requestHeader.getUsername())\n            .thenCompose(old -> {\n                if (old == null) {\n                    throw new AuthenticationException(\"The user is not exist\");\n                }\n                if (old.getUserType() == UserType.SUPER && isNotSuperUserLogin(request)) {\n                    throw new AuthenticationException(\"The super user can only be update by super user\");\n                }\n                return this.brokerController.getAuthenticationMetadataManager().updateUser(user);\n            }).thenAccept(nil -> response.setCode(ResponseCode.SUCCESS))\n            .exceptionally(ex -> {\n                LOGGER.error(\"update user {} error\", requestHeader.getUsername(), ex);\n                return handleAuthException(response, ex);\n            })\n            .join();\n        return response;\n    }\n\n    private RemotingCommand deleteUser(ChannelHandlerContext ctx,\n        RemotingCommand request) throws RemotingCommandException {\n        final RemotingCommand response = RemotingCommand.createResponseCommand(null);\n\n        DeleteUserRequestHeader requestHeader = request.decodeCommandCustomHeader(DeleteUserRequestHeader.class);\n\n        this.brokerController.getAuthenticationMetadataManager().getUser(requestHeader.getUsername())","sourceCodeStart":3281,"sourceCodeEnd":3317,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/broker/src/main/java/org/apache/rocketmq/broker/processor/AdminBrokerProcessor.java#L3281-L3317","documentation":"Update-user handler guard: if the user being updated (old record) has UserType.SUPER and the requester is not a super user, the chain throws AuthenticationException('The super user can only be update by super user'). Only super users may modify super-user accounts.","triggerScenarios":"UPDATE_USER sent with credentials of a normal (non-super) user targeting a SUPER user account.","commonSituations":"Automation using a low-privilege access key to rotate the super user's password; token/accessKey of an ordinary user configured in tools (mqadmin) while editing the admin account.","solutions":["Authenticate the request with a super user's credentials (session/accessKey of an existing SUPER user).","If no super user is available, recover per docs: temporarily clear/disable ACL metadata (acl config file) on the broker to regain super access, then fix credentials.","Keep automated tooling that manages users on a dedicated super-user account."],"exampleFix":"// before: default/normal accessKey used\nmqadmin updateUser -n broker:10911 -u admin -p newPass\n// -> AuthenticationException\n\n// after: authenticate as super user\nmqadmin updateUser -n broker:10911 -u admin -p newPass \\\n  -su <superAccessKey> -sp <superSecretKey>","handlingStrategy":"validation","validationCode":"// before sending UPDATE_USER for a SUPER target, confirm the session principal is SUPER\nif (targetUser.getUserType() == UserType.SUPER && !session.isSuper()) {\n    throw new SecurityException(\"use super-user credentials\");\n}","typeGuard":null,"tryCatchPattern":"catch (CompletionException e) { if (e.getCause() instanceof AuthenticationException) { /* surface 401/403 to operator; do not retry with same creds */ } throw e; }","preventionTips":["Run user-management tooling authenticated as a super user.","Test target user type via getUser before attempting updates."],"tags":["rocketmq","broker","acl","user-management","authorization","admin-api"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}