RockteMQ-AI commented on issue #11408: URL: https://github.com/apache/rocketmq/issues/11408#issuecomment-6142148891
**Issue Evaluation** Category: `type/bug` | Status: **Confirmed** The reported issue has been verified against the current codebase. **Root Cause:** The two broker-container startup paths (`BrokerContainerStartup.createAndInitializeBroker` and `BrokerContainerProcessor.addBroker`) build `AuthConfig` from per-broker properties but never populate `configName`, `clusterName`, or `authConfigPath` — unlike the standalone `BrokerStartup` and `Proxy Configuration` paths. All three fields remain `null`. **Impact:** 1. ACL 2.0 metadata (users/acls RocksDB) is created at relative path `null/users` and `null/acls` under the process CWD instead of `<storePathRootDir>/config/` 2. Cluster-scoped admin requests are authorized as `Cluster:null`, breaking all cluster-level ACL policies 3. Container restarts from a different CWD silently lose the user/ACL store **Severity:** High — affects all broker-container deployments with ACL 2.0 enabled. The reporter has indicated they will submit a PR for this issue. --- *Automated evaluation by RockteMQ-AI* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
