alibaba/nacos · error · NacosRuntimeException

e.getErrMsg()

Error message

e.getErrMsg()

What it means

Thrown by NacosRoleServiceRemoteImpl.deletePermission after the remote DELETE to another Nacos server node returned a non-2xx response. RemoteServerUtil.singleCheckResult wraps the HTTP failure into a NacosException, which is then rethrown as a NacosRuntimeException carrying the remote server's original error code and message. This path is used when the console node forwards auth operations to a server node over HTTP.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/roles/NacosRoleServiceRemoteImpl.java:85

            throw new NacosRuntimeException(e.getErrCode(), e.getErrMsg());
        } catch (Exception unpectedException) {
            throw new NacosRuntimeException(NacosException.SERVER_ERROR,
                unpectedException.getMessage());
        }
    }
    
    @Override
    public void deletePermission(String role, String resource, String action) {
        Query query = Query.newInstance().addParam("role", role).addParam("resource", resource)
            .addParam("action", action);
        try {
            HttpRestResult<String> result = nacosRestTemplate.delete(
                buildRemotePermissionUrlPath(AuthConstants.PERMISSION_PATH),
                RemoteServerUtil.buildServerRemoteHeader(), query, String.class);
            RemoteServerUtil.singleCheckResult(result);
            invalidateRolePermissions(role);
        } catch (NacosException e) {
            throw new NacosRuntimeException(e.getErrCode(), e.getErrMsg());
        } catch (Exception unpectedException) {
            throw new NacosRuntimeException(NacosException.SERVER_ERROR,
                unpectedException.getMessage());
        }
    }
    
    @Override
    public List<PermissionInfo> getPermissions(String role) {
        List<PermissionInfo> cached = getCachedPermissionInfoMap().get(role);
        if (cached != null) {
            return cached;
        }
        reload();
        return getCachedPermissionInfoMap().get(role);
    }
    
    @Override
    public Page<PermissionInfo> getPermissions(String role, int pageNo, int pageSize) {

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Inspect e.getErrMsg()/errCode from the NacosRuntimeException to see the remote server's actual reason.
2. Verify nacos.core.auth.server.identity.key/value match across all nodes (cluster.conf members).
3. Confirm the permission (role, resource, action) still exists on the target node before deleting.
4. Ensure the target server node is healthy and reachable, then retry.

try {
    roleService.deletePermission(role, resource, action);
} catch (NacosRuntimeException e) {
    // e.getErrCode() is the remote server's HTTP-derived code
    if (e.getCode() == 404 /* or the permission-not-found code */) {
        LOG.warn("Permission already absent: {}/{}/{}", role, resource, action);
    } else {
        throw e; // propagate genuine server/auth errors
    }
}

When it happens

Trigger: Cluster/console deployment calling deletePermission where the target server node rejects it (e.g. permission row missing, DB error, auth failure on the forwarded request). The remote server identity header may be invalid, or the permission tuple does not exist remotely.

Common situations: Console separated from server nodes; server-identity key/value mismatch between nodes; the permission was already deleted; DB connectivity on the target node is broken; targeting a node that is mid-restart.

Related errors

• 500
• 500
• 500
• HTTP error! status: ${response.status}
• HTTP error! status: ${response.status}

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/01a5338d5b897c38. Report an issue: GitHub.