alibaba/nacos · error · IllegalArgumentException

user + username + not exist!

Error message

user  + username +  not exist!

What it means

Thrown by UserControllerV3.updateUserPassword as IllegalArgumentException when the target username does not resolve to a stored User. The update-password endpoint fetches the user and rejects the operation if it is absent.

Solutions

1. Verify the username exists via getUser before issuing the update.
2. Trim and normalize the username to avoid whitespace/case mismatch.
3. Handle the IllegalArgumentException by surfacing a 404 to the caller rather than a 500.

Example fix

// before
userDetailsService.updateUserPassword(username, newPassword); // throws if absent

// after
if (userDetailsService.getUser(username) == null) {
    return Result.failure("user not exist");
}
userDetailsService.updateUserPassword(username, newPassword);

if (userDetailsService.getUser(username) == null) {
    return Result.failure("user not exist");
}
userDetailsService.updateUserPassword(username, newPassword);

boolean userExists(NacosUserService s, String u) { return s.getUser(u) != null; }

try {
    userDetailsService.updateUserPassword(username, newPassword);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("not exist")) return notFound();
    throw e;
}

When it happens

Trigger: PUT/PATCH to update a user's password for a username that does not exist (typo, already deleted, or wrong namespace scope).

Common situations: Renaming then updating the old name; operating on a user deleted by another admin; case-sensitivity or whitespace mismatches in the username.

Related errors

• cannot delete admin: + username
• user ' + username + ' already exist!
• Plugin config value cannot be null
• Plugin config value is not a boolean
• Plugin config value is not a number

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/04be860209f17ca6. Report an issue: GitHub.

Appendix: source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/controller/v3/UserControllerV3.java:208

    public Result<String> updateUser(@RequestParam String username,
        @RequestParam String newPassword,
        HttpServletResponse response, HttpServletRequest request) throws IOException {
        try {
            if (!hasPermission(username, request)) {
                response.sendError(HttpServletResponse.SC_FORBIDDEN, "authorization failed!");
                return null;
            }
        } catch (HttpSessionRequiredException e) {
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "session expired!");
            return null;
        } catch (AccessException exception) {
            response.sendError(HttpServletResponse.SC_FORBIDDEN, "authorization failed!");
            return null;
        }
        
        User user = userDetailsService.getUser(username);
        if (user == null) {
            throw new IllegalArgumentException("user " + username + " not exist!");
        }
        
        userDetailsService.updateUserPassword(username, newPassword);
        return Result.success("update user ok!");
        
    }
    
    private boolean hasPermission(String username, HttpServletRequest request)
        throws HttpSessionRequiredException, AccessException {
        if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) {
            return true;
        }
        // Fixes #13959. If the user is server identity, should not check permission.
        if (isFromServerIdentity(request)) {
            return true;
        }
        IdentityContext identityContext =
            RequestContextHolder.getContext().getAuthContext().getIdentityContext();

View on GitHub (pinned to 9b989acdf1)