alibaba/nacos · error · IllegalArgumentException

Plugin config value must be positive: {key}

Error message

Plugin config value must be positive: {key}

What it means

Thrown by LdapAuthPluginConfig.parsePositiveLong() when the timeout config value parses as a valid long but is zero or negative. The LDAP timeout must be a positive duration (milliseconds), so non-positive values are rejected with IllegalArgumentException naming the 'timeout' key.

Source

Thrown at plugin-default-impl/nacos-ldap-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/ldap/LdapAuthPluginConfig.java:141

            caseSensitive, ignorePartialResultException);
    }
    
    private static String value(Map<String, String> config, String key, String defaultValue) {
        if (config == null || !config.containsKey(key)) {
            return defaultValue;
        }
        String result = config.get(key);
        if (result == null) {
            throw new IllegalArgumentException("Plugin config value cannot be null: " + key);
        }
        return result;
    }
    
    private static long parsePositiveLong(String value, String key) {
        try {
            long result = Long.parseLong(value);
            if (result <= 0) {
                throw new IllegalArgumentException("Plugin config value must be positive: " + key);
            }
            return result;
        } catch (NumberFormatException e) {
            throw new IllegalArgumentException("Plugin config value is not a number: " + key, e);
        }
    }
    
    private static boolean parseBoolean(String value, String key) {
        if (!Boolean.TRUE.toString().equalsIgnoreCase(value)
            && !Boolean.FALSE.toString().equalsIgnoreCase(value)) {
            throw new IllegalArgumentException("Plugin config value is not a boolean: " + key);
        }
        return Boolean.parseBoolean(value);
    }
    
    public String getUrl() {
        return url;
    }

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Set the timeout to a positive millisecond value (default is 3000).
2. If unsure, remove the timeout key from config to fall back to the 3000ms default.
3. Review the LDAP config file for a negative or zero timeout entry.

Example fix

# before
nacos.plugin.auth.ldap.timeout=0

# after
nacos.plugin.auth.ldap.timeout=3000

String timeoutStr = config.getOrDefault("timeout", "3000");
long timeout = Long.parseLong(timeoutStr);
if (timeout <= 0) {
    throw new IllegalArgumentException("timeout must be positive");
}

static boolean isValidPositiveLong(String value) {
    try {
        return Long.parseLong(value) > 0;
    } catch (NumberFormatException e) {
        return false;
    }
}

try {
    LdapAuthPluginConfig parsed = LdapAuthPluginConfig.from(config);
} catch (IllegalArgumentException e) {
    // if message contains 'must be positive', fix the timeout value
}

When it happens

Trigger: LdapAuthPluginConfig.from() parses the timeout key; the value (e.g. "0", "-1") is a number but <= 0, triggering the positivity check at line 141.

Common situations: An operator sets nacos.plugin.auth.ldap.timeout=0 intending 'no timeout' (which is not how this plugin works); a negative value slips in from a misconfigured environment variable.

Related errors

• Plugin config value is not a number: {key}
• Plugin config value cannot be null: {key}
• Plugin config value is not a boolean: {key}
• username is blank
• user not found!

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/446ec54b466e241c. Report an issue: GitHub.