alibaba/nacos · error · AccessException

user not found!

Error message

user not found!

What it means

Thrown by LdapAuthenticationManager.authenticate when the username parameter is blank. The LDAP authentication flow cannot query a directory server without a username, so it rejects the request immediately with AccessException("user not found!") rather than attempting a bind. This is the first guard in the authenticate method.

Source

Thrown at plugin-default-impl/nacos-ldap-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/authenticate/LdapAuthenticationManager.java:83

        this.filterPrefix = filterPrefix;
        this.caseSensitive = caseSensitive;
        this.configProvider = null;
    }
    
    public LdapAuthenticationManager(LdapTemplateProvider ldapTemplateProvider,
        NacosUserService userDetailsService, TokenManagerDelegate jwtTokenManager,
        NacosRoleService roleService, LdapAuthPluginConfigProvider configProvider) {
        super(userDetailsService, jwtTokenManager, roleService);
        this.ldapTemplateProvider = ldapTemplateProvider;
        this.filterPrefix = null;
        this.caseSensitive = true;
        this.configProvider = configProvider;
    }
    
    @Override
    public NacosUser authenticate(String username, String rawPassword) throws AccessException {
        if (StringUtils.isBlank(username)) {
            throw new AccessException("user not found!");
        }
        
        if (!isCaseSensitive()) {
            username = username.toLowerCase();
        }
        
        if (username.toUpperCase().startsWith(AuthConstants.LDAP_PREFIX)) {
            throw new AccessException("user not found!");
        }
        
        try {
            return super.authenticate(username, rawPassword);
        } catch (AccessException | UsernameNotFoundException ignored) {
            if (Loggers.AUTH.isWarnEnabled()) {
                Loggers.AUTH.warn("try login with LDAP, user: {}", username);
            }
        }
        

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Ensure the login endpoint validates that username is non-blank before invoking the LDAP authentication manager.
2. Return a 400 Bad Request with a clear message when the client omits the username.
3. If the caller extracts the username from a token/claim, verify the claim exists before authentication.

Example fix

// before
NacosUser user = ldapAuthManager.authenticate(username, rawPassword);

// after
if (StringUtils.isBlank(username)) {
    throw new AccessException("user not found!");
}
NacosUser user = ldapAuthManager.authenticate(username, rawPassword);

if (StringUtils.isBlank(username)) {
    throw new AccessException("user not found!");
}
NacosUser user = ldapAuthManager.authenticate(username, rawPassword);

static boolean isValidLoginUsername(String username) {
    return username != null && !username.trim().isEmpty();
}

try {
    NacosUser user = ldapAuthManager.authenticate(username, rawPassword);
} catch (AccessException e) {
    // map to 401 Unauthorized; do not leak whether user exists
}

When it happens

Trigger: Calling authenticate(username, rawPassword) where username is null, empty, or whitespace-only. Triggered by a login API (HTTP or gRPC) that forwards an empty username field to the LDAP auth manager.

Common situations: A login form or API client sends an empty username; an automated SSO/token-exchange path calls authenticate with a null identifier extracted from a JWT claim that was missing.

Related errors

• LDAP login failed.
• Plugin config value cannot be null: {key}
• Plugin config value must be positive: {key}
• Plugin config value is not a number: {key}
• Plugin config value is not a boolean: {key}

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/0da3b8b7ac7d2ebf. Report an issue: GitHub.