alibaba/nacos · error · IllegalArgumentException

Plugin config value must be positive:

Error message

Plugin config value must be positive: 

What it means

Thrown by parsePositiveLong() when a numeric config value (jwks-cache-ttl-seconds or authorization-timeout-ms) parses but is zero or negative. Both must be strictly positive.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/config/OidcAuthPluginConfig.java:187

            strictNonceValidation, strictAudienceValidation);
    }
    
    private static String value(Map<String, String> config, String key, String defaultValue) {
        if (config == null || !config.containsKey(key)) {
            return defaultValue;
        }
        String result = config.get(key);
        if (result == null) {
            throw new IllegalArgumentException("Plugin config value cannot be null: " + key);
        }
        return StringUtils.isBlank(result) ? defaultValue : result;
    }
    
    private static long parsePositiveLong(String value, String key) {
        try {
            long result = Long.parseLong(value);
            if (result <= 0) {
                throw new IllegalArgumentException("Plugin config value must be positive: " + key);
            }
            return result;
        } catch (NumberFormatException e) {
            throw new IllegalArgumentException("Plugin config value is not a number: " + key, e);
        }
    }
    
    private static boolean parseBoolean(String value, String key) {
        if (!Boolean.TRUE.toString().equalsIgnoreCase(value)
            && !Boolean.FALSE.toString().equalsIgnoreCase(value)) {
            throw new IllegalArgumentException("Plugin config value is not a boolean: " + key);
        }
        return Boolean.parseBoolean(value);
    }
    
    public boolean isValid() {
        return StringUtils.isNotBlank(issuerUri) && StringUtils.isNotBlank(clientId);
    }

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Set the value to a positive number of seconds (e.g. the default jwks-cache-ttl-seconds=3600, authorization-timeout-ms=5000).
2. To minimize caching, use a small positive value (e.g. 1) rather than 0.
3. The appended key name tells you which of the two settings is wrong.

Example fix

// before
nacos.plugin.auth.oidc.jwks-cache-ttl-seconds=0
// after
nacos.plugin.auth.oidc.jwks-cache-ttl-seconds=3600

// Validate positive-numeric config values before building the plugin config
private static long requirePositive(String key, String raw) {
    long v = Long.parseLong(raw);
    if (v <= 0) throw new IllegalArgumentException(key + " must be > 0, got " + v);
    return v;
}

try {
    OidcAuthPluginConfig.from(configMap);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("must be positive")) {
        // reset the offending numeric key to its default and retry
        log.warn("Resetting non-positive numeric OIDC config: {}", e.getMessage());
    }
}

When it happens

Trigger: Setting nacos.plugin.auth.oidc.jwks-cache-ttl-seconds=0 or authorization-timeout-ms to a negative number.

Common situations: Operator sets jwks-cache-ttl-seconds=0 intending to disable caching (the code does not support that); copy-paste of a negative value; misunderstanding that 0 is invalid.

Related errors

• Plugin config value cannot be null:
• Plugin config value is not a number:
• Plugin config value is not a boolean:
• Base directory cannot be blank
• listener is null

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/10ebb635ff6134ff. Report an issue: GitHub.