alibaba/nacos · error · NacosApiException

ACCESS_DENIED

ACCESS_DENIED

Error message

No permission to manage visibility grants for resource: {resourceName}

What it means

Thrown by DefaultVisibilityGrantService.checkManageGrantAuthority() when the current authenticated identity is not authorized to manage visibility grants for a resource. The method allows access only if: (1) authentication is disabled, (2) the current user is a global administrator, or (3) the current user is the resource owner. If none of these conditions hold, it throws NacosApiException with code NO_RIGHT (access denied).

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/visibility/DefaultVisibilityGrantService.java:226

        return resource.orElseThrow(() -> new NacosApiException(NacosException.NOT_FOUND,
            ErrorCode.RESOURCE_NOT_FOUND,
            "resource not found: " + resourceName));
    }
    
    private void checkManageGrantAuthority(VisibilityResource resource) throws NacosException {
        // Allow access rules: 1. Authentication not enabled; 2. Global administrator; 3. Resource owner.
        if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) {
            return;
        }
        String currentUsername = AuthIdentityUtils.resolveCurrentUsername();
        if (AuthIdentityUtils.isCurrentIdentityGlobalAdmin(currentUsername)) {
            return;
        }
        if (StringUtils.isNotBlank(currentUsername)
            && currentUsername.equals(resource.getOwner())) {
            return;
        }
        throw new NacosApiException(NacosException.NO_RIGHT, ErrorCode.ACCESS_DENIED,
            "No permission to manage visibility grants for resource: "
                + resource.getResourceName());
    }
    
    private void validateResourceTypeAndName(String resourceType, String resourceName)
        throws NacosException {
        if (StringUtils.isBlank(resourceType)) {
            throw new NacosApiException(NacosException.INVALID_PARAM, ErrorCode.PARAMETER_MISSING,
                "resourceType is blank");
        }
        if (StringUtils.isBlank(resourceName)) {
            throw new NacosApiException(NacosException.INVALID_PARAM, ErrorCode.PARAMETER_MISSING,
                "resourceName is blank");
        }
    }
    
    private void validateUsername(String username) throws NacosException {
        if (StringUtils.isBlank(username)) {

View on GitHub (pinned to 9b989acdf1)

Solutions

Ensure the calling user has global admin privileges, or is the owner of the target resource.
Verify that AuthIdentityUtils.resolveCurrentUsername() correctly resolves the caller's identity — check that the authentication context is properly populated.
If the resource owner is wrong, update the resource's ownership metadata in the owning module.
Use an admin account to perform visibility grant management operations.

Example fix

// Before calling grant/revoke, check authority client-side:
if (!AuthIdentityUtils.isCurrentIdentityGlobalAdmin(currentUser)
    && !currentUser.equals(resource.getOwner())) {
    // abort with a user-friendly message
    return Result.failure("Insufficient permissions to manage visibility grants");
}

Defensive patterns

Strategy: validation

Validate before calling

// Verify authority before calling grant/revoke
boolean authEnabled = NacosAuthConfigHolder.getInstance().isAnyAuthEnabled();
if (authEnabled) {
    String currentUser = AuthIdentityUtils.resolveCurrentUsername();
    boolean isAdmin = AuthIdentityUtils.isCurrentIdentityGlobalAdmin(currentUser);
    boolean isOwner = currentUser != null && currentUser.equals(resource.getOwner());
    if (!isAdmin && !isOwner) {
        throw new AccessDeniedException("Insufficient permissions for visibility grant management");
    }
}

Type guard

public static boolean canManageVisibilityGrants(VisibilityResource resource) {
    if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) return true;
    String user = AuthIdentityUtils.resolveCurrentUsername();
    return AuthIdentityUtils.isCurrentIdentityGlobalAdmin(user)
        || (user != null && user.equals(resource.getOwner()));
}

Try / catch

try {
    service.grant(namespaceId, resourceType, resourceName, username, action);
} catch (NacosApiException e) {
    if (e.getErrCode() == NacosException.NO_RIGHT) {
        return Result.failure("Access denied: you must be an admin or the resource owner");
    }
    throw e;
}

Prevention

Use an admin account for visibility grant management operations.
Verify the current user's role and the resource owner before calling grant/revoke.
Ensure AuthIdentityUtils.resolveCurrentUsername() returns a correct value in the auth context.

When it happens

Trigger: Calling grant() or revoke() when: authentication is enabled AND the current user is neither a global admin nor the owner of the target resource. The resource owner is determined by VisibilityResource.getOwner().

Common situations: A regular (non-admin) user attempts to manage visibility grants for a resource they don't own; a user's ownership metadata is incorrect or missing; the current username resolution fails to identify the caller (AuthIdentityUtils.resolveCurrentUsername returns blank).

Related errors

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/f1a1dbb69361c74f. Report an issue: GitHub.