alibaba/nacos · error · AccessException

User not found! Please check user exist or password is right

Error message

User not found! Please check user exist or password is right!

What it means

Thrown by AbstractAuthenticationManager.authenticate(username, rawPassword) when EITHER username OR rawPassword is blank. It raises AccessException with the shared USER_NOT_FOUND_MESSAGE constant. This is the blank-input guard distinct from the credential-mismatch guard at line 67.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/authenticate/AbstractAuthenticationManager.java:61

    
    protected NacosUserService userDetailsService;
    
    protected TokenManagerDelegate jwtTokenManager;
    
    protected NacosRoleService roleService;
    
    public AbstractAuthenticationManager(NacosUserService userDetailsService,
        TokenManagerDelegate jwtTokenManager,
        NacosRoleService roleService) {
        this.userDetailsService = userDetailsService;
        this.jwtTokenManager = jwtTokenManager;
        this.roleService = roleService;
    }
    
    @Override
    public NacosUser authenticate(String username, String rawPassword) throws AccessException {
        if (StringUtils.isBlank(username) || StringUtils.isBlank(rawPassword)) {
            throw new AccessException(USER_NOT_FOUND_MESSAGE);
        }
        NacosUserDetails nacosUserDetails =
            (NacosUserDetails) userDetailsService.loadUserByUsername(username);
        if (nacosUserDetails == null
            || !PasswordEncoderUtil.matches(rawPassword, nacosUserDetails.getPassword())) {
            throw new AccessException(USER_NOT_FOUND_MESSAGE);
        }
        return new NacosUser(nacosUserDetails.getUsername(), jwtTokenManager.createToken(username));
    }
    
    @Override
    public NacosUser authenticate(String token) throws AccessException {
        if (StringUtils.isBlank(token)) {
            throw new AccessException(USER_NOT_FOUND_MESSAGE);
        }
        return jwtTokenManager.parseToken(token);
    }
    

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Ensure both username and password are non-blank before calling authenticate (validate at the caller).
2. Check SDK config: nacos.core.auth.* username/password properties must be set when auth is enabled.
3. If using env vars, verify they are exported and non-empty in the runtime environment.

Example fix

// before
manager.authenticate(user, null); // blank password -> AccessException

// after
if (StringUtils.isBlank(user) || StringUtils.isBlank(pass)) {
    throw new IllegalArgumentException("username and password are required");
}
manager.authenticate(user, pass);

if (StringUtils.isBlank(username) || StringUtils.isBlank(rawPassword)) {
    throw new IllegalArgumentException("username and password are required");
}
manager.authenticate(username, rawPassword);

static boolean hasCredentials(String u, String p) {
    return StringUtils.isNotBlank(u) && StringUtils.isNotBlank(p);
}

When it happens

Trigger: Calling authenticate(username, password) where username is empty/null or password is empty/null. Reached via the username/password login path (login API, SDK auth, or internal authenticate calls).

Common situations: Clients sending an empty password when none was configured; misconfigured SDK credential properties; programmatic login with null variables due to upstream config loading failure.

Related errors

• 403
• authorization failed!
• Request parameter `agentSpecCard` should not be null or empt
• Request parameter `agentSpecCard` is invalid and cannot be p
• Required parameter `agentSpecCard.name` is not present.

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/ae4485b2d6f287da. Report an issue: GitHub.