{"id":"24307279382ceb57","repo":"apache/kafka","slug":"not-authorized-to-access-topics-set-of-tp-topic","errorCode":null,"errorMessage":"Not authorized to access topics: ${Set.of(tp.topic())}","messagePattern":"Not authorized to access topics: (.+?)","errorType":"exception","errorClass":"TopicAuthorizationException","httpStatus":null,"severity":"error","filePath":"clients/src/main/java/org/apache/kafka/clients/consumer/internals/ShareFetchCollector.java","lineNumber":175,"sourceCode":"                error == Errors.REPLICA_NOT_AVAILABLE ||\n                error == Errors.KAFKA_STORAGE_ERROR ||\n                error == Errors.FENCED_LEADER_EPOCH ||\n                error == Errors.OFFSET_NOT_AVAILABLE) {\n            log.debug(\"Error in fetch for partition {}: {}\", tp, error.exceptionName());\n            requestMetadataUpdate(metadata, subscriptions, tp.topicPartition());\n        } else if (error == Errors.UNKNOWN_TOPIC_OR_PARTITION) {\n            log.warn(\"Received unknown topic or partition error in fetch for partition {}.\", tp);\n            requestMetadataUpdate(metadata, subscriptions, tp.topicPartition());\n        } else if (error == Errors.UNKNOWN_TOPIC_ID) {\n            log.warn(\"Received unknown topic ID error in fetch for partition {}.\", tp);\n            requestMetadataUpdate(metadata, subscriptions, tp.topicPartition());\n        } else if (error == Errors.INCONSISTENT_TOPIC_ID) {\n            log.warn(\"Received inconsistent topic ID error in fetch for partition {}.\", tp);\n            requestMetadataUpdate(metadata, subscriptions, tp.topicPartition());\n        } else if (error == Errors.TOPIC_AUTHORIZATION_FAILED) {\n            // Log the actual partition and not just the topic to help with ACL propagation issues in large clusters\n            log.warn(\"Not authorized to read from partition {}.\", tp.topicPartition());\n            throw new TopicAuthorizationException(Set.of(tp.topic()));\n        } else if (error == Errors.UNKNOWN_LEADER_EPOCH) {\n            log.debug(\"Received unknown leader epoch error in fetch for partition {}.\", tp);\n        } else if (error == Errors.UNKNOWN_SERVER_ERROR) {\n            log.warn(\"Unknown server error while fetching topic-partition {}.\",\n                    tp.topicPartition());\n        } else if (error == Errors.CORRUPT_MESSAGE) {\n            throw new KafkaException(\"Encountered corrupt message when fetching topic-partition \"\n                    + tp.topicPartition());\n        } else {\n            throw new IllegalStateException(\"Unexpected error code \" + error.code()\n                    + \" while fetching from topic-partition \" + tp.topicPartition());\n        }\n    }\n}\n","sourceCodeStart":157,"sourceCodeEnd":190,"githubUrl":"https://github.com/apache/kafka/blob/c31c9215e131f8c17e79f8901b48c13ee6aa8e7a/clients/src/main/java/org/apache/kafka/clients/consumer/internals/ShareFetchCollector.java#L157-L190","documentation":"Thrown by ShareFetchCollector.handleInitializeErrors when a fetch response carries Errors.TOPIC_AUTHORIZATION_FAILED for a topic-partition. The share consumer has no read ACL for that topic, so the collector logs the failing partition and raises TopicAuthorizationException naming the offending topic(s). It is the share group's enforcement of Kafka ACLs (cluster READ + topic DESCRIBE/READ) at fetch time.","triggerScenarios":"The principal configured via SASL/KafkaClient lacks the READ operation ACL on the topic being fetched in share mode; an ACL was revoked between subscribe and poll; a topic-pattern subscription included a topic the client is not authorized to read.","commonSituations":"Service principal not granted READ on the topic; ACLs scoped per-topic but the client subscribes broadly; recent ACL cleanup/rotation removed access; cross-environment (dev->prod) config copied without adjusting principal; mTLS/SASL credentials point to the wrong user.","solutions":["Grant READ ACL to the principal on the topic (and DESCRIBE on the cluster/topic): kafka-acls.sh --add --operation Read --principal ... --topic <name>.","Verify the configured principal matches the one granted ACLs (sasl.jaas.config / client credentials).","If using a pattern subscription, ensure ACLs cover all matched topics or narrow the pattern.","Re-fetch metadata after ACL changes and retry; ACL propagation may lag briefly in large clusters."],"exampleFix":"# before\n# principal 'User:app' has no ACL on topic 'orders'\n\n# after\nbin/kafka-acls.sh --bootstrap-server broker:9092 \\\n  --add --allow-principal User:app --operation Read --topic orders\nbin/kafka-acls.sh --bootstrap-server broker:9092 \\\n  --add --allow-principal User:app --operation Describe --topic orders","handlingStrategy":"try-catch","validationCode":"// Validate ACLs before subscribing when possible using the AdminClient.\ntry (Admin admin = Admin.create(commonProps)) {\n    DescribeAclsResult res = admin.describeAcls(\n        AclBindingFilter.forResourceType(ResourceType.TOPIC));\n    Set<String> allowedTopics = res.values().get().stream()\n        .map(b -> b.pattern().name())\n        .collect(Collectors.toSet());\n    topics.retainAll(allowedTopics);\n    if (topics.isEmpty()) throw new IllegalStateException(\"No topics authorized\");\n}\nconsumer.subscribe(topics);","typeGuard":null,"tryCatchPattern":"try {\n    consumer.subscribe(topics);\n    consumer.poll(Duration.ofSeconds(5));\n} catch (org.apache.kafka.common.errors.TopicAuthorizationException e) {\n    // Missing READ/DESCRIBE ACL on the listed topics.\n    log.error(\"Authorization failed for topics: {}\", e.unauthorizedTopics(), e);\n    // Surface to operator so they can grant ACLs:\n    //   bin/kafka-acls.sh --add --allow-principal User:... --operation READ --topic <t>\n    alertOps(e.unauthorizedTopics());\n}","preventionTips":["Grant READ + DESCRIBE on topics (and GROUP READ on the share group) before the app starts.","Use the same principal for AdminClient ACL validation as for the consumer.","Watch for ACL propagation lag in large clusters; retry briefly before failing.","Do not swallow TopicAuthorizationException; it indicates a real misconfiguration."],"tags":["share-consumer","authorization","acl","security"],"analyzedSha":"c31c9215e131f8c17e79f8901b48c13ee6aa8e7a","analyzedAt":"2026-08-03T12:34:05.770Z","schemaVersion":2}