alibaba/nacos · critical · NacosRuntimeException

50002

50002

Error message

Empty identity, Please set `nacos.core.auth.server.identity.key` and `nacos.core.auth.server.identity.value`, detail: https://nacos.io/docs/latest/manual/admin/auth/

What it means

Thrown by NacosServerAdminAuthConfig.validate() (ADMIN_API auth scope) when auth is enabled and the auth type is set, but the server identity key or value is empty. The server identity (nacos.core.auth.server.identity.key / .value) is a shared secret used for inter-server trust bypass. Error code 50002 (AuthErrorCode.EMPTY_IDENTITY). Both key and value must be non-empty; either missing triggers this.

Source

Thrown at core/src/main/java/com/alibaba/nacos/core/auth/NacosServerAdminAuthConfig.java:73

    public NacosServerAdminAuthConfig() {
        super("NacosServerAdminAuth");
        resetConfig();
        validate();
    }
    
    /**
     * Validate auth config.
     */
    private void validate() {
        if (!authEnabled) {
            return;
        }
        if (StringUtils.isEmpty(nacosAuthSystemType)) {
            throw new NacosRuntimeException(AuthErrorCode.INVALID_TYPE.getCode(),
                AuthErrorCode.INVALID_TYPE.getMsg());
        }
        if (StringUtils.isEmpty(serverIdentityKey) || StringUtils.isEmpty(serverIdentityValue)) {
            throw new NacosRuntimeException(AuthErrorCode.EMPTY_IDENTITY.getCode(),
                AuthErrorCode.EMPTY_IDENTITY.getMsg());
        }
    }
    
    @Override
    public String getAuthScope() {
        return NACOS_SERVER_ADMIN_AUTH_SCOPE;
    }
    
    /**
     * server auth function is open.
     *
     * @return server auth function is open
     */
    @Override
    public boolean isAuthEnabled() {
        return authEnabled;
    }

View on GitHub (pinned to 9b989acdf1)

Solutions

Set both nacos.core.auth.server.identity.key and nacos.core.auth.server.identity.value to non-empty, identical values on every cluster node.
Use a strong, unique shared secret for the value (not the default 'security').
Ensure all nodes in the cluster share the same identity pair.
Restart the server after setting the properties.

Example fix

# before (broken)
nacos.core.auth.enabled=true
nacos.plugin.auth.type=nacos
# (no identity set)

# after (fixed)
nacos.core.auth.enabled=true
nacos.plugin.auth.type=nacos
nacos.core.auth.server.identity.key=serverIdentity
nacos.core.auth.server.identity.value=<strong-unique-secret>

Defensive patterns

Strategy: validation

Validate before calling

# Shell pre-flight check
if grep -q 'nacos.core.auth.enabled=true' application.properties; then
  KEY=$(grep -oP 'nacos.core.auth.server.identity.key=\K.*' application.properties)
  VAL=$(grep -oP 'nacos.core.auth.server.identity.value=\K.*' application.properties)
  if [ -z "$KEY" ] || [ -z "$VAL" ]; then
    echo 'ERROR: server identity key/value must both be set when auth is enabled'; exit 1;
  fi
fi

Prevention

Set both nacos.core.auth.server.identity.key and .value to non-empty identical values on every node.
Use a strong unique secret, not the default 'security'.
Distribute the identity pair consistently across the cluster.
Add a deployment pre-flight check for the identity pair.

When it happens

Trigger: Auth enabled with a valid type, but nacos.core.auth.server.identity.key or nacos.core.auth.server.identity.value is unset/empty in application.properties. Applies to the admin API auth scope. Thrown at config validation (startup or dynamic reset).

Common situations: Operator sets auth.type but forgets the identity pair. Only the key is set (value empty) or vice versa. Cluster nodes with mismatched identity configs. Fresh deployment copying a partial config template.

Related errors

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/4d2e56aa9ba3d286. Report an issue: GitHub.