{"record":{"id":"e0392f1720ed81bd","repo":"apache/rocketmq","slug":"get-acl-from-rocksdb-failed","errorCode":null,"errorMessage":"get Acl from RocksDB failed.","messagePattern":"get Acl from RocksDB failed\\.","errorType":"exception","errorClass":"AuthorizationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authorization/provider/LocalAuthorizationMetadataProvider.java","lineNumber":203,"sourceCode":"\n        public AclCacheLoader(ConfigRocksDBStorage storage) {\n            this.storage = storage;\n        }\n\n        @Override\n        public Acl load(String subjectKey) {\n            try {\n                byte[] keyBytes = subjectKey.getBytes(StandardCharsets.UTF_8);\n                Subject subject = Subject.of(subjectKey);\n\n                byte[] valueBytes = this.storage.get(AUTH_METADATA_COLUMN_FAMILY, keyBytes);\n                if (ArrayUtils.isEmpty(valueBytes)) {\n                    return EMPTY_ACL;\n                }\n                Acl acl = JSON.parseObject(valueBytes, Acl.class);\n                return Acl.of(subject, acl.getPolicies());\n            } catch (Exception e) {\n                throw new AuthorizationException(\"get Acl from RocksDB failed.\", e);\n            }\n        }\n    }\n}\n","sourceCodeStart":185,"sourceCodeEnd":208,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authorization/provider/LocalAuthorizationMetadataProvider.java#L185-L208","documentation":"Thrown inside LocalAuthorizationMetadataProvider's AclCacheLoader.load() when reading an Acl back from RocksDB fails — either the raw get() throws, Subject.of(subjectKey) cannot parse the key, or JSON.parseObject cannot decode the stored value. Because this runs inside a Caffeine cache load, the AuthorizationException surfaces on whatever request triggered the cache miss (getAcl / authorization checks).","triggerScenarios":"A cache miss for a subject whose stored JSON is corrupt (partial write after crash), a stored value written by an incompatible older version whose Acl JSON layout no longer parses, or a subjectKey whose format does not round-trip through Subject.of().","commonSituations":"Upgrading RocketMQ across versions where the serialized Acl schema changed; RocksDB corruption after an unclean shutdown; a subject key with unexpected delimiters breaking Subject.of parsing.","solutions":["Check the nested cause: a JSON parse error points to a corrupt or version-incompatible stored value, an IllegalArgumentException from Subject.of points to a malformed key","Delete and re-create the affected Acl entry to rewrite a clean value (deleteAcl + createAcl)","After upgrades, re-import ACLs if the stored schema is incompatible rather than mixing versions against one store","If many keys fail, consider rebuilding the acls RocksDB directory from an ACL export"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    Acl acl = provider.getAcl(subject).join();\n} catch (CompletionException e) {\n    Throwable real = ExceptionUtils.getRealException(e);\n    if (real instanceof AuthorizationException && real.getCause() instanceof JSONException) {\n        // corrupt/incompatible stored value: delete and re-create the Acl entry\n    }\n}","preventionTips":["Re-import (delete+create) ACLs after version upgrades instead of reusing old stores","Export ACLs to JSON backups so a corrupt store can be rebuilt quickly"],"tags":["auth","rocksdb","cache","deserialization","acl","rocketmq"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}