---
title: "TopicAuthorizationException: authorizing a Kafka producer"
description: "The Kafka authorizer denies by default: producer App:orders-svc fails with TopicAuthorizationException until an ALLOW Write ACL on topic orders is added."
url: https://monedula.dev/kafka-simulator/scenarios/acls-authorizing-a-producer/
---

# TopicAuthorizationException: authorizing a Kafka producer

Scenario 10.5.1 · ACLs: authorizing a producer. Authorization (ACLs & RBAC) · Intermediate · about 3 min · Apache Kafka 4.3.

The authorizer is deny-by-default: a producer with no ACL is denied (TopicAuthorizationException), then an ALLOW Write ACL lets the same principal produce.

Run it: https://monedula.dev/kafka-simulator/playground/?scenario=10.5.1

## What you start with

Kafka's authorizer is deny-by-default: a request with no matching ACL is rejected. Here a producer with no ACL is denied with a TopicAuthorizationException, then an ALLOW Write ACL is added for that principal and the same produce succeeds.

## Step by step

1. **Authorization on · no ACLs** (t+0.000s): The cluster has authorization enabled but an empty ACL set. Kafka's authorizer is deny-by-default: with no matching ALLOW rule, every operation is refused. Producer p1 authenticates as the principal App:orders-svc - an identity string, not a real SASL login. [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=10.5.1&t=0)
2. **Produce denied (no ACL)** (t+1.000s): p1 tries to produce to orders. No ACL grants App:orders-svc the Write operation on this topic, so the broker rejects the request with TopicAuthorizationException before any record reaches the log. The producer goes to an error state and nothing is appended. [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=10.5.1&t=1)
3. **ACL added: Write on orders** (t+1.700s): An ALLOW ACL is added: principal App:orders-svc, operation Write, resource topic orders. This is the single rule the deny-by-default authorizer was waiting for - the authorization model now contains exactly one rule. [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=10.5.1&t=2)
4. **Same producer now writes** (t+2.300s): With the matching ALLOW ACL in place, the very same producer (same principal, no restart) produces successfully - the record is appended and acknowledged. Authorization changed the outcome; nothing else did. [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=10.5.1&t=3)

## The takeaway

Access is granted by explicit ALLOW ACLs on a principal-and-resource - without one, even a correctly configured client cannot write, which is exactly what deny-by-default guarantees.

## Further reading

- [Apache Kafka documentation](https://kafka.apache.org/43/security/authorization-and-acls/)

## Troubleshooting

- [TopicAuthorizationException in Kafka: causes and fixes](https://monedula.dev/kafka-simulator/troubleshooting/topic-authorization-failed/)