使用http外部授权（mq客户端和授权api在同一个服务），订阅小概率失败

EMQX 错误报告
,
1

环境

  • EMQX 版本：v6.0.0
  • 操作系统版本：linux

认证、授权的http api与客户端在用一个服务。启动时，认证api调用成功后才会走订阅授权逻辑。

订阅会有小概率失败的情况，失败时emqx服务未曾调用授权api。且看日志这个http授权器有ignore的缓存（authorization_module_ignore），客户端error日志有”resource not connected“提示。
[error] clientid: system_local, msg: http_server_query_failed, peername: 192.168.56.1:52444, username: system, reason: {resource_error,#{reason => not_connected,msg => “resource not connected”}}, resource: <<“authz:http:3”>>

为什么先调用的认证api没有问题，而后调用的授权api会出现资源未连接的情况。

2

如果只看这一句原因了话，那应该是你的 http server 有问题。有时连不上。
不过你可以传一下完整的日志上来看看。

3

这是订阅失败时的客户端日志：
2026-01-04T17:35:19.109745+08:00 [MQTT] system_local@192.168.56.1:52444 msg: mqtt_packet_received, packet: CONNECT(Q0, R0, D0, ClientId=system_local, ProtoName=MQTT, ProtoVsn=5, CleanStart=true, KeepAlive=60, Username=system, Password=), username: system
2026-01-04T17:35:19.109934+08:00 [MULTI_TENANCY] system_local@192.168.56.1:52444 msg: no_tenant_namespace, username: system
2026-01-04T17:35:19.110122+08:00 [QUERY] system_local@192.168.56.1:52444 msg: http_connector_received, action_id: undefined, client_ids: [], connector: authn:http:4, namespace: global, note: the request body is redacted due to security reasons, request: {<<“/emqx/authenticate”>>,[{<<“content-type”>>,<<“application/json”>>}],<<"“>>}, rule_ids: , rule_trigger_ts: , state: [port: 21180, scheme: http, request: undefined, host: {192,168,1,47}, connect_timeout: 15000, pool_type: random, pool_name: authn:http:4, installed_actions: ], username: system
2026-01-04T17:35:20.167487+08:00 [AUTHN] system_local@192.168.56.1:52444 msg: http_response, provider: emqx_authn_http, request: [body: {“username”:“system”,“password”:”[password]“,“clientId”:“system_local”}, headers: [{<<“content-type”>>,<<“application/json”>>}], method: post, url: http://192.168.1.47:21180/emqx/authenticate, path_query: /emqx/authenticate], resource: authn:http:4, response: [status: 200, body: {“result”:“allow”,“is_superuser”:false}, headers: [{<<“content-type”>>,<<“application/json”>>},{<<“transfer-encoding”>>,<<“chunked”>>},{<<“date”>>,<<“Sun, 04 Jan 2026 09:35:19 GMT”>>}]], username: system
2026-01-04T17:35:20.167695+08:00 [AUTHN] system_local@192.168.56.1:52444 msg: authenticator_result, authenticator: password_based:http, payload_encode: text, result: Encoded(text)={ok,#{client_attrs => #{},is_superuser => false}}, username: system
2026-01-04T17:35:20.167838+08:00 [AUTHN] system_local@192.168.56.1:52444 msg: authentication_result, payload_encode: text, reason: chain_result, result: Encoded(text)={stop,{ok,#{client_attrs => #{},is_superuser => false}}}, username: system
2026-01-04T17:35:20.168382+08:00 [RULE] system_local@192.168.56.1:52444 msg: skip_apply_disabled_rule, rule_id: client_event_WH_D, username: system
2026-01-04T17:35:20.168656+08:00 [RULE] system_local@192.168.56.1:52444 msg: skip_apply_disabled_rule, rule_id: client_event_WH_D, username: system
2026-01-04T17:35:20.168795+08:00 [MQTT] system_local@192.168.56.1:52444 msg: mqtt_packet_sent, packet: CONNACK(Q0, R0, D0, AckFlags=0, ReasonCode=0), username: system
2026-01-04T17:35:21.214549+08:00 [MQTT] system_local@192.168.56.1:52444 msg: mqtt_packet_received, packet: SUBSCRIBE(Q1, R0, D0, PacketId=65526 TopicFilters=[test/device/#(#{nl => 0,qos => 1,rap => 0,rh => 0})]), username: system
2026-01-04T17:35:21.214781+08:00 [AUTHZ] system_local@192.168.56.1:52444 msg: authorization_module_ignore, action: SUBSCRIBE(Q1), authorize_type: client_info, module: emqx_authz_client_info, topic: test/device/#, username: system
2026-01-04T17:35:21.214862+08:00 [error] clientid: system_local, msg: http_server_query_failed, peername: 192.168.56.1:52444, username: system, reason: {resource_error,#{reason => not_connected,msg => “resource not connected”}}, resource: <<“authz:http:3”>>
2026-01-04T17:35:21.215092+08:00 [AUTHZ] system_local@192.168.56.1:52444 msg: authorization_module_ignore, action: SUBSCRIBE(Q1), authorize_type: http, module: emqx_authz_http, topic: test/device/#, username: system
2026-01-04T17:35:21.215134+08:00 [warning] tag: AUTHZ, clientid: system_local, msg: authorization_permission_denied, peername: 192.168.56.1:52444, username: system, topic: test/device/#, action: SUBSCRIBE(Q1), source: ‘authorization.no_match’ config
2026-01-04T17:35:21.215440+08:00 [RULE] system_local@192.168.56.1:52444 msg: skip_apply_disabled_rule, rule_id: client_event_WH_D, username: system
2026-01-04T17:35:21.215542+08:00 [MQTT] system_local@192.168.56.1:52444 msg: mqtt_packet_sent, packet: SUBACK(Q0, R0, D0, PacketId=65526, ReasonCodes=[135]), username: system
2026-01-04T17:35:31.288219+08:00 [MQTT] system_local@192.168.56.1:52444 msg: mqtt_packet_received, packet: SUBSCRIBE(Q1, R0, D0, PacketId=65526 TopicFilters=[test/device/#(#{nl => 0,qos => 1,rap => 0,rh => 0})]), username: system
2026-01-04T17:35:31.288448+08:00 [AUTHZ] system_local@192.168.56.1:52444 msg: authorization_module_ignore, action: SUBSCRIBE(Q1), authorize_type: client_info, module: emqx_authz_client_info, topic: test/device/#, username: system
2026-01-04T17:35:31.288588+08:00 [QUERY] system_local@192.168.56.1:52444 msg: http_connector_received, action_id: undefined, client_ids: , connector: authz:http:3, namespace: global, note: the request body is redacted due to security reasons, request: {<<”/emqx/authorize">>,[{<<“content-type”>>,<<“application/json”>>}],<<“******”>>}, rule_ids: , rule_trigger_ts: , state: [port: 21180, scheme: http, request: undefined, host: {192,168,1,47}, connect_timeout: 15000, pool_type: random, pool_name: authz:http:3, installed_actions: ], username: system
2026-01-04T17:35:31.305620+08:00 [AUTHZ] system_local@192.168.56.1:52444 msg: authorization_matched_allow, action: SUBSCRIBE(Q1), authorize_type: http, module: emqx_authz_http, topic: test/device/#, username: system
2026-01-04T17:35:31.305919+08:00 [RULE] system_local@192.168.56.1:52444 msg: skip_apply_disabled_rule, rule_id: client_event_WH_D, username: system
2026-01-04T17:35:31.306011+08:00 [SUBSCRIBE] system_local@192.168.56.1:52444 msg: subscribe, sub_id: system_local, sub_opts: [nl: 0, subid: 2, qos: 1, rap: 0, rh: 0, sub_props: [Subscription-Identifier: 2]], topic: test/device/#, username: system
2026-01-04T17:35:31.306362+08:00 [RULE] system_local@192.168.56.1:52444 msg: skip_apply_disabled_rule, rule_id: client_event_WH_D, username: system
2026-01-04T17:35:31.306497+08:00 [MQTT] system_local@192.168.56.1:52444 msg: mqtt_packet_sent, packet: SUBACK(Q0, R0, D0, PacketId=65526, ReasonCodes=[1]), username: system

4

如果出了这个问题大概率就是你的 http server 有时是真连不上了。

你可以用 tcpdump 在你的 http server 上trace 一下。看看定期的 health check（emqx 会 tcp connect 过来检查的）和正常的 authenticate， authorization 2 个接口的请示是不是正常。
调试的时候把连接池设置为 1， http管道也设置为 1

image
image2178×760 38 KB