alibaba/nacos · error · AccessException

user not found

Error message

user not found

What it means

Thrown by LdapAuthenticationManager.authenticate inside the catch (Exception e) block that wraps the user-provisioning step. After a successful ldapLogin, the code loads or creates the LDAP-prefixed user via userDetailsService. Any unexpected exception (not UsernameNotFoundException) during that load/create is logged as [LDAP-LOGIN] failed and rethrown as a generic AccessException("user not found").

Source

Thrown at plugin-default-impl/nacos-ldap-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/authenticate/LdapAuthenticationManager.java:119

        
        UserDetails userDetails;
        try {
            if (!ldapLogin(username, rawPassword)) {
                throw new AccessException("LDAP login failed.");
            }
            userDetails =
                userDetailsService.loadUserByUsername(AuthConstants.LDAP_PREFIX + username);
        } catch (UsernameNotFoundException exception) {
            String ldapUsername = AuthConstants.LDAP_PREFIX + username;
            userDetailsService.createUser(ldapUsername, AuthConstants.LDAP_DEFAULT_ENCODED_PASSWORD,
                false);
            User user = new User();
            user.setUsername(ldapUsername);
            user.setPassword(AuthConstants.LDAP_DEFAULT_ENCODED_PASSWORD);
            userDetails = new NacosUserDetails(user);
        } catch (Exception e) {
            Loggers.AUTH.error("[LDAP-LOGIN] failed", e);
            throw new AccessException("user not found");
        }
        
        return new NacosUser(userDetails.getUsername(),
            jwtTokenManager.createToken(userDetails.getUsername()));
    }
    
    private boolean ldapLogin(String username, String password) {
        return ldapTemplateProvider.getLdapTemplate().authenticate("",
            new EqualsFilter(getFilterPrefix(), username).toString(), password);
    }
    
    private String getFilterPrefix() {
        LdapAuthPluginConfig config = getConfig();
        return config == null ? filterPrefix : config.getFilterPrefix();
    }
    
    private boolean isCaseSensitive() {
        LdapAuthPluginConfig config = getConfig();

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Check the server logs for the '[LDAP-LOGIN] failed' ERROR entry which logs the original exception 'e' — that root cause is the real problem.
2. Verify the internal database connectivity and that the users table is writable.
3. If a constraint violation appears, check for duplicate LDAP-prefixed usernames and clean up stale entries.
4. Resolve the underlying persistence issue, then retry the login.

try {
    NacosUser user = ldapAuthManager.authenticate(username, rawPassword);
} catch (AccessException e) {
    // inspect server log for '[LDAP-LOGIN] failed' root cause before retrying
    // do NOT retry unchanged; the persistence error will recur
}

When it happens

Trigger: ldapLogin succeeds, but userDetailsService.loadUserByUsername or createUser throws a non-UsernameNotFound exception (e.g. database connection error, constraint violation, persistence layer failure). The catch-all converts it to AccessException.

Common situations: The Nacos internal database is temporarily unavailable; a duplicate-key constraint is hit during auto-provisioning of the LDAP user; the persistence layer (Derby/MySQL) has a connectivity issue.

Related errors

• user not found!
• LDAP login failed.
• LDAP auth plugin requires org.springframework.ldap:spring-ld
• Plugin config value cannot be null: {key}
• Plugin config value must be positive: {key}

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/19153d8182069312. Report an issue: GitHub.