alibaba/nacos · warning · NacosApiException

PARAMETER_VALIDATE_ERROR

PARAMETER_VALIDATE_ERROR

Error message

user '{username}' not found

What it means

Thrown by DefaultVisibilityGrantService.validateGranteeExists() when the grantee username does not correspond to any existing user in the user service (userService.getUser(username) returns null). This ensures visibility grants are only created for real users. The error code is INVALID_PARAM with ErrorCode.PARAMETER_VALIDATE_ERROR.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/visibility/DefaultVisibilityGrantService.java:253

                "resourceType is blank");
        }
        if (StringUtils.isBlank(resourceName)) {
            throw new NacosApiException(NacosException.INVALID_PARAM, ErrorCode.PARAMETER_MISSING,
                "resourceName is blank");
        }
    }
    
    private void validateUsername(String username) throws NacosException {
        if (StringUtils.isBlank(username)) {
            throw new NacosApiException(NacosException.INVALID_PARAM, ErrorCode.PARAMETER_MISSING,
                "username is blank");
        }
    }
    
    private void validateGranteeExists(String username) throws NacosException {
        User grantee = userService.getUser(username);
        if (grantee == null) {
            throw new NacosApiException(NacosException.INVALID_PARAM,
                ErrorCode.PARAMETER_VALIDATE_ERROR,
                "user '" + username + "' not found");
        }
    }
    
    private String normalizeGrantAction(String action) throws NacosException {
        try {
            // Persist write grants as "rw" so write authorization can imply read visibility.
            return VisibilityGrantRoleHelper.normalizeStoredAction(action);
        } catch (IllegalArgumentException e) {
            throw new NacosApiException(NacosException.INVALID_PARAM,
                ErrorCode.PARAMETER_VALIDATE_ERROR, e.getMessage());
        }
    }
    
    private boolean userHasRole(String username, String roleName) {
        List<RoleInfo> roles = roleService.getRoles(username);
        if (CollectionUtils.isEmpty(roles)) {

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Verify the username exists by calling userService.getUser(username) before submitting the grant/revoke request.
2. Check for typos or case sensitivity issues in the username.
3. If the user was recently deleted, inform the client and cancel the grant operation.
4. Ensure user provisioning is complete before attempting to assign visibility grants.

Example fix

// Check user existence before calling grant:
if (userService.getUser(username) == null) {
    return Result.failure("User '" + username + "' does not exist");
}
service.grant(namespaceId, resourceType, resourceName, username, action);

// Verify the grantee user exists before granting
User grantee = userService.getUser(username);
if (grantee == null) {
    return Result.failure("User '" + username + "' does not exist");
}

public static boolean userExists(NacosUserService userService, String username) {
    return StringUtils.isNotBlank(username) && userService.getUser(username) != null;
}

try {
    service.grant(namespaceId, resourceType, resourceName, username, action);
} catch (NacosApiException e) {
    if (e.getDetailErrCode() == ErrorCode.PARAMETER_VALIDATE_ERROR.getCode()) {
        return Result.failure(e.getMessage()); // "user 'xxx' not found"
    }
    throw e;
}

When it happens

Trigger: Calling grant() or revoke() with a username that doesn't exist in the Nacos user database — e.g. a typo in the username, a previously-deleted user, or a username from a different identity provider that isn't synced.

Common situations: The grantee was deleted between the time the client loaded the user list and submitted the grant; a typo in the username; a username from an external IdP that hasn't been provisioned in Nacos; the user exists in a different namespace or auth realm.

Related errors

• PARAMETER_MISSING
• action is blank
• unsupported action: {action}
• username is blank
• 10000

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/8940e7669f0b8e31. Report an issue: GitHub.