alibaba/nacos · error · AccessException

User not found! Please check user exist or password is…

Error message

User not found! Please check user exist or password is right!

What it means

Thrown by AbstractAuthenticationManager.authenticate(username, rawPassword) when EITHER username OR rawPassword is blank. It raises AccessException with the shared USER_NOT_FOUND_MESSAGE constant. This is the blank-input guard distinct from the credential-mismatch guard at line 67.

Solutions

1. Ensure both username and password are non-blank before calling authenticate (validate at the caller).
2. Check SDK config: nacos.core.auth.* username/password properties must be set when auth is enabled.
3. If using env vars, verify they are exported and non-empty in the runtime environment.

Example fix

// before
manager.authenticate(user, null); // blank password -> AccessException

// after
if (StringUtils.isBlank(user) || StringUtils.isBlank(pass)) {
    throw new IllegalArgumentException("username and password are required");
}
manager.authenticate(user, pass);

if (StringUtils.isBlank(username) || StringUtils.isBlank(rawPassword)) {
    throw new IllegalArgumentException("username and password are required");
}
manager.authenticate(username, rawPassword);

static boolean hasCredentials(String u, String p) {
    return StringUtils.isNotBlank(u) && StringUtils.isNotBlank(p);
}

When it happens

Trigger: Calling authenticate(username, password) where username is empty/null or password is empty/null. Reached via the username/password login path (login API, SDK auth, or internal authenticate calls).

Common situations: Clients sending an empty password when none was configured; misconfigured SDK credential properties; programmatic login with null variables due to upstream config loading failure.

Related errors

• 403
• authorization failed!
• 400
• 500
• 500

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/ae4485b2d6f287da. Report an issue: GitHub.

Appendix: source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/authenticate/AbstractAuthenticationManager.java:61

    
    protected NacosUserService userDetailsService;
    
    protected TokenManagerDelegate jwtTokenManager;
    
    protected NacosRoleService roleService;
    
    public AbstractAuthenticationManager(NacosUserService userDetailsService,
        TokenManagerDelegate jwtTokenManager,
        NacosRoleService roleService) {
        this.userDetailsService = userDetailsService;
        this.jwtTokenManager = jwtTokenManager;
        this.roleService = roleService;
    }
    
    @Override
    public NacosUser authenticate(String username, String rawPassword) throws AccessException {
        if (StringUtils.isBlank(username) || StringUtils.isBlank(rawPassword)) {
            throw new AccessException(USER_NOT_FOUND_MESSAGE);
        }
        NacosUserDetails nacosUserDetails =
            (NacosUserDetails) userDetailsService.loadUserByUsername(username);
        if (nacosUserDetails == null
            || !PasswordEncoderUtil.matches(rawPassword, nacosUserDetails.getPassword())) {
            throw new AccessException(USER_NOT_FOUND_MESSAGE);
        }
        return new NacosUser(nacosUserDetails.getUsername(), jwtTokenManager.createToken(username));
    }
    
    @Override
    public NacosUser authenticate(String token) throws AccessException {
        if (StringUtils.isBlank(token)) {
            throw new AccessException(USER_NOT_FOUND_MESSAGE);
        }
        return jwtTokenManager.parseToken(token);
    }
    

View on GitHub (pinned to 9b989acdf1)