alibaba/nacos · error · AccessException

LDAP login failed.

Error message

LDAP login failed.

What it means

Thrown by LdapAuthenticationManager.authenticate after super.authenticate (the default/JWT path) fails AND the subsequent ldapLogin(username, rawPassword) returns false. A false return from ldapLogin means the LDAP directory rejected the bind (wrong password, user not in directory, or filter mismatch). The method throws AccessException("LDAP login failed.").

Source

Thrown at plugin-default-impl/nacos-ldap-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/authenticate/LdapAuthenticationManager.java:105

            username = username.toLowerCase();
        }
        
        if (username.toUpperCase().startsWith(AuthConstants.LDAP_PREFIX)) {
            throw new AccessException("user not found!");
        }
        
        try {
            return super.authenticate(username, rawPassword);
        } catch (AccessException | UsernameNotFoundException ignored) {
            if (Loggers.AUTH.isWarnEnabled()) {
                Loggers.AUTH.warn("try login with LDAP, user: {}", username);
            }
        }
        
        UserDetails userDetails;
        try {
            if (!ldapLogin(username, rawPassword)) {
                throw new AccessException("LDAP login failed.");
            }
            userDetails =
                userDetailsService.loadUserByUsername(AuthConstants.LDAP_PREFIX + username);
        } catch (UsernameNotFoundException exception) {
            String ldapUsername = AuthConstants.LDAP_PREFIX + username;
            userDetailsService.createUser(ldapUsername, AuthConstants.LDAP_DEFAULT_ENCODED_PASSWORD,
                false);
            User user = new User();
            user.setUsername(ldapUsername);
            user.setPassword(AuthConstants.LDAP_DEFAULT_ENCODED_PASSWORD);
            userDetails = new NacosUserDetails(user);
        } catch (Exception e) {
            Loggers.AUTH.error("[LDAP-LOGIN] failed", e);
            throw new AccessException("user not found");
        }
        
        return new NacosUser(userDetails.getUsername(),
            jwtTokenManager.createToken(userDetails.getUsername()));

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Verify the user's password is correct against the LDAP directory directly (e.g. ldapsearch bind test).
2. Check that the configured filter-prefix (default "uid") matches the directory's user-naming attribute (could be "cn", "sAMAccountName", etc.).
3. Confirm the user entry actually exists under the configured base DN.
4. Enable DEBUG on the LDAP auth logger to see the exact filter and server response.

Example fix

// before: filter-prefix mismatch causes bind failure
// config: filter-prefix=uid  (directory uses cn)

// after: set the correct filter-prefix
// custom.properties: nacos.plugin.auth.ldap.filter-prefix=cn

try {
    NacosUser user = ldapAuthManager.authenticate(username, rawPassword);
} catch (AccessException e) {
    if ("LDAP login failed.".equals(e.getMessage())) {
        // credentials rejected by directory; prompt user to re-enter
    } else {
        // other auth failure
    }
}

When it happens

Trigger: Login flow: default auth fails first, then authenticate() calls ldapLogin which delegates to LdapTemplate.authenticate. The directory server rejects the credentials (invalid password or no matching entry under the configured filter), returning false.

Common situations: User mistypes their LDAP password; the LDAP filter-prefix (e.g. "uid") does not match the directory's attribute; the user exists in Nacos's local DB but not in the LDAP directory; LDAP server is reachable but returns no match.

Related errors

• user not found!
• LDAP auth plugin requires org.springframework.ldap:spring-ld
• Plugin config value cannot be null: {key}
• Plugin config value must be positive: {key}
• Plugin config value is not a number: {key}

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/9b73a617b7a74055. Report an issue: GitHub.