RabbitMQ Shovel Failing with PRECONDITION_FAILED (User-ID Mismatch)

Products

• VMware Tanzu Data Intelligence
• VMware Tanzu RabbitMQ
• RabbitMQ

Issue/Introduction

A RabbitMQ Shovel status shows as terminated with an error message matching this pattern:

PRECONDITION_FAILED - user_id property set to '<ORIGINAL_PUBLISHER_ID>' but authenticated user was '<SHOVEL_USER_ID>'

When this happens, message processing halts and data stops moving between queues.

Environment

All supported RabbitMQ versions 

Cause

By default, RabbitMQ enforces a strict security feature called Validated User-ID. If an upstream application stamps an explicit identity tag onto a message's user_id header, RabbitMQ verifies that the identity matches the user account currently trying to publish it.

Because the Shovel plugin connects to the destination broker using an administrative or generic service account, the identities mismatch. The destination broker flags this as unauthorized identity spoofing, rejects the incoming message payload, and abruptly terminates the Shovel's channel.

Resolution

Here are suggested options to recover. Option 1 is recommended for most production environments.

Option 1: Grant "impersonator" Rights to the Shovel Account (Recommended)

This is the cleanest and most secure approach. It explicitly grants your Shovel service account the native privilege to forward messages on behalf of other upstream publishing application IDs.

Run the following command on the destination RabbitMQ broker:

rabbitmqctl set_user_tags <SHOVEL_USER_ID> impersonator

For full details, see the official documentation: Validated User-ID - Impersonator Tag

Option 2: Disable User-ID Checking Globally

(Only if your environment does not rely on message identity validation.)

1. Open the rabbitmq.conf configuration file on your destination RabbitMQ server instances.
2. Add the following parameter: identity.check_user_id = false
3. Restart the RabbitMQ server service to apply the change.

Option 3: Align Shovel Credentials to Match the Message Headers

(Use when security policies require keeping validation active.)

Re-create the Shovel using the original publisher's credentials in the destination connection string.

Example:

rabbitmqctl set_parameter shovel <SHOVEL_NAME> \
'{"src-protocol":"amqp091","src-uri":"amqps://<SHOVEL_USER_ID>:<PASSWORD>@<SOURCE_HOST>/<VHOST>", \
"dest-protocol":"amqp091","dest-uri":"amqps://<ORIGINAL_PUBLISHER_ID>:<PASSWORD>@<DESTINATION_HOST>/<VHOST>", \
"src-queue":"<QUEUE_NAME>","dest-queue":"<QUEUE_NAME>","prefetch-count":100,"ack-mode":"on-confirm"}' \
--vhost <VHOST_NAME>

 

Additional Information

Verification Steps:

• Check Shovel status: rabbitmqctl shovel_status (or via Management UI).
• Monitor destination broker logs for successful message publishes.
• Publish a test message upstream and confirm it arrives at the destination queue.

 

References:

• RabbitMQ Validated User-ID Documentation