alibaba/nacos · error · AccessException

No valid OIDC token found

Error message

No valid OIDC token found

What it means

Thrown by OidcAuthenticationManager.authenticate(IdentityContext) after both token sources are exhausted: no 'Authorization: Bearer ...' header and no accessToken query/form parameter. It means the incoming request carried no OIDC credential at all.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/OidcAuthenticationManager.java:99

    
    /**
     * Authenticate user from identity context.
     *
     * @param identityContext identity context containing credentials
     * @return authenticated OidcUser
     * @throws AccessException if authentication fails
     */
    public OidcUser authenticate(IdentityContext identityContext) throws AccessException {
        // Try to extract Bearer token from Authorization header
        String token = extractBearerToken(identityContext);
        
        if (StringUtils.isBlank(token)) {
            // Try accessToken parameter
            token = identityContext.getParameter(OidcProtocolConstants.ACCESS_TOKEN_PARAM, "");
        }
        
        if (StringUtils.isBlank(token)) {
            throw new AccessException("No valid OIDC token found");
        }
        
        return authenticate(token);
    }
    
    /**
     * Extract Bearer token from identity context.
     *
     * @param identityContext identity context
     * @return token string or null
     */
    private String extractBearerToken(IdentityContext identityContext) {
        String authHeader =
            identityContext.getParameter(OidcProtocolConstants.AUTHORIZATION_HEADER, "");
        if (StringUtils.isNotBlank(authHeader)
            && authHeader.startsWith(OidcProtocolConstants.BEARER_PREFIX)) {
            return authHeader.substring(OidcProtocolConstants.BEARER_PREFIX.length());
        }

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Ensure the client sends 'Authorization: Bearer <oidc-access-token>' on every authenticated request.
2. If using the parameter fallback, supply accessToken in the request.
3. Check that an intermediary (reverse proxy, gateway) is not stripping the Authorization header.
4. Confirm the OIDC login flow completed and the client obtained a token before calling protected endpoints.

Example fix

// before: request sent with no credentials
GET /v3/admin/ns/service/list
// after: attach the OIDC access token
GET /v3/admin/ns/service/list
Authorization: Bearer eyJhbGciOi...

// Pre-check both credential sources before calling authenticate
String bearer = extractBearer(identityContext);
String param = identityContext.getParameter(OidcProtocolConstants.ACCESS_TOKEN_PARAM, "");
if (StringUtils.isBlank(bearer) && StringUtils.isBlank(param)) {
    respondUnauthorized(); // return 401 instead of letting authenticate throw
}

try {
    manager.authenticate(identityContext);
} catch (AccessException e) {
    if ("No valid OIDC token found".equals(e.getMessage())) {
        // No credentials present — standard 401, not a server error
        respondUnauthorized();
    } else {
        throw e;
    }
}

When it happens

Trigger: A request to a protected Nacos resource that has neither an Authorization: Bearer header nor an 'accessToken' parameter in the identity context.

Common situations: Client forgot to attach the access token; token expired and the client sent no token; a browser hitting an API endpoint without a session; misconfigured gateway stripping the Authorization header.

Related errors

• Token is required
• Token endpoint not configured
• Token exchange failed:
• Failed to sign payload
• Client secret is required for state signing

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/bab09c02ceaa6deb. Report an issue: GitHub.