alibaba/nacos · error · AccessException

Failed to initiate login: {errorMessage}

Error message

Failed to initiate login: {errorMessage}

What it means

Thrown by AuthorizationCodeHandler.buildAuthorizationUrl as the catch-all for any non-AccessException during authorization URL construction. The handler wraps the original exception message into AccessException("Failed to initiate login: " + e.getMessage()) and logs the full stack trace at ERROR. This covers failures in building the OIDC AuthenticationRequest (e.g. invalid redirect URI, scope parsing, client ID).

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/AuthorizationCodeHandler.java:141

            AuthenticationRequest authRequest = new AuthenticationRequest.Builder(
                new ResponseType("code"),
                new Scope(config.getScope().split(" ")),
                new ClientID(config.getClientId()),
                URI.create(redirectUri))
                .endpointURI(URI.create(authEndpoint))
                .state(new State(state))
                .nonce(new Nonce(nonce))
                .build();
            
            String authUrl = authRequest.toURI().toString();
            LOGGER.debug("Built authorization URL: {}", authUrl);
            return authUrl;
            
        } catch (AccessException e) {
            throw e;
        } catch (Exception e) {
            LOGGER.error("Failed to build authorization URL", e);
            throw new AccessException("Failed to initiate login: " + e.getMessage());
        }
    }
    
    /**
     * Exchange authorization code for tokens and authenticate user.
     *
     * @param code        authorization code from IdP
     * @param state       state parameter for CSRF verification
     * @param redirectUri the redirect URI used in the authorization request
     * @return authenticated OidcUser
     * @throws AccessException if authentication fails
     */
    public OidcUser exchangeCodeForUser(String code, String state, String redirectUri)
        throws AccessException {
        try {
            // Verify and decode state (self-contained, no cache lookup needed)
            StateData stateData = verifyAndDecodeState(state);
            if (stateData == null) {

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Check the server log for 'Failed to build authorization URL' — it logs the full underlying exception with the real root cause.
2. Validate that redirectUri is a well-formed absolute URI before calling buildAuthorizationUrl.
3. Ensure the OIDC clientId and scope config values are set and valid.
4. Fix the specific underlying error identified in the logged stack trace.

// Validate redirectUri before calling buildAuthorizationUrl
try {
    URI uri = URI.create(redirectUri);
    if (uri.getScheme() == null || uri.getHost() == null) {
        throw new IllegalArgumentException("redirectUri must be absolute");
    }
} catch (Exception e) {
    // reject malformed redirectUri before login
}

static boolean isAbsoluteUri(String uri) {
    try {
        URI u = URI.create(uri);
        return u.getScheme() != null && u.getHost() != null;
    } catch (Exception e) {
        return false;
    }
}

try {
    String authUrl = handler.buildAuthorizationUrl(redirectUri);
} catch (AccessException e) {
    // check server log 'Failed to build authorization URL' for root cause
}

When it happens

Trigger: Any Exception (other than AccessException, which is rethrown as-is) thrown while constructing the AuthenticationRequest: URI.create fails on a malformed redirectUri, scope.split produces invalid Scope objects, or ClientID/endpoint URI construction fails.

Common situations: The redirectUri passed in is malformed or not a valid absolute URI; the configured scope string contains invalid characters; a config value (clientId) is null causing NPE in the OIDC builder.

Related errors

• Authentication failed: {errorMessage}
• Authorization endpoint not configured
• Invalid or expired state parameter
• Nonce not present in ID token. Set 'nacos.plugin.auth.oidc.s
• Nonce mismatch: expected %s, got %s

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/43848354cf0303ae. Report an issue: GitHub.