alibaba/nacos · error · AccessException

authorization failed!

Error message

authorization failed!

What it means

Thrown by AbstractAuthenticationManager.authorize when a non-admin user without the global admin role attempts an operation for which roleService.hasPermission returns false. It is an AccessException meaning the caller is authenticated but lacks the required permission on the requested resource/action.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/authenticate/AbstractAuthenticationManager.java:109

        }
        
        return user;
    }
    
    @Override
    public void authorize(Permission permission, NacosUser nacosUser) throws AccessException {
        if (Loggers.AUTH.isDebugEnabled()) {
            Loggers.AUTH.debug("auth permission: {}, nacosUser: {}", permission, nacosUser);
        }
        if (nacosUser.isGlobalAdmin()) {
            return;
        }
        if (hasGlobalAdminRole(nacosUser)) {
            return;
        }
        
        if (!roleService.hasPermission(nacosUser, permission)) {
            throw new AccessException("authorization failed!");
        }
    }
    
    private String resolveToken(HttpServletRequest request) {
        String bearerToken = request.getHeader(AuthConstants.AUTHORIZATION_HEADER);
        if (StringUtils.isNotBlank(bearerToken)
            && bearerToken.startsWith(AuthConstants.TOKEN_PREFIX)) {
            return bearerToken.substring(AuthConstants.TOKEN_PREFIX.length());
        }
        bearerToken = request.getParameter(Constants.ACCESS_TOKEN);
        
        return bearerToken;
    }
    
    @Override
    public boolean hasGlobalAdminRole(String username) {
        return roleService.hasGlobalAdminRole(username);
    }

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Grant the required role/permission to the user (RAM permission API: /v3/auth/permission) scoped to the resource and action.
2. Use an account with the global admin role for administrative operations.
3. Confirm the resource string and action in the request match the permission entry (READ vs WRITE, exact resource pattern).

Example fix

// before: read-only user issues a write
permission = new Permission("*:*", ActionTypes.WRITE);
manager.authorize(permission, readOnlyUser); // -> authorization failed!

// after: grant write permission or use admin
// POST /v3/auth/permission { role, resource:"*:*", action:"w" }
manager.authorize(permission, authorizedUser);

// pre-check role grants before issuing a secured op
boolean canWrite = nacosUser.isGlobalAdmin()
    || roleService.hasPermission(nacosUser, new Permission(resource, ActionTypes.WRITE));
if (!canWrite) throw new AccessException("insufficient permission");

static boolean canPerform(NacosRoleService rs, NacosUser u, Permission p) {
    return u != null && (u.isGlobalAdmin() || rs.hasPermission(u, p));
}

try {
    manager.authorize(permission, nacosUser);
} catch (AccessException e) {
    if ("authorization failed!".equals(e.getMessage())) {
        // return 403 Forbidden to the client
    } else throw e;
}

When it happens

Trigger: An authenticated non-admin user invokes a secured API (config read/write, naming write, admin op) without a matching role/permission grant. Reached after authentication succeeds and the authorize(permission, nacosUser) check fails.

Common situations: A read-only user attempting a write; missing RAM permission entry for a namespace or resource; role grants not propagated after a role change; client using a service account scoped too narrowly.

Related errors

• ACCESS_DENIED
• Code: %d, Message: %s.
• User not found! Please check user exist or password is right
• role {role} not found!
• e.getErrMsg()

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/b461a0b2ef7116b6. Report an issue: GitHub.