alibaba/nacos · error · IllegalArgumentException

user + username + not exist!

Error message

user  + username +  not exist!

What it means

Thrown by UserControllerV3.updateUserPassword as IllegalArgumentException when the target username does not resolve to a stored User. The update-password endpoint fetches the user and rejects the operation if it is absent.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/controller/v3/UserControllerV3.java:208

    public Result<String> updateUser(@RequestParam String username,
        @RequestParam String newPassword,
        HttpServletResponse response, HttpServletRequest request) throws IOException {
        try {
            if (!hasPermission(username, request)) {
                response.sendError(HttpServletResponse.SC_FORBIDDEN, "authorization failed!");
                return null;
            }
        } catch (HttpSessionRequiredException e) {
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "session expired!");
            return null;
        } catch (AccessException exception) {
            response.sendError(HttpServletResponse.SC_FORBIDDEN, "authorization failed!");
            return null;
        }
        
        User user = userDetailsService.getUser(username);
        if (user == null) {
            throw new IllegalArgumentException("user " + username + " not exist!");
        }
        
        userDetailsService.updateUserPassword(username, newPassword);
        return Result.success("update user ok!");
        
    }
    
    private boolean hasPermission(String username, HttpServletRequest request)
        throws HttpSessionRequiredException, AccessException {
        if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) {
            return true;
        }
        // Fixes #13959. If the user is server identity, should not check permission.
        if (isFromServerIdentity(request)) {
            return true;
        }
        IdentityContext identityContext =
            RequestContextHolder.getContext().getAuthContext().getIdentityContext();

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Verify the username exists via getUser before issuing the update.
2. Trim and normalize the username to avoid whitespace/case mismatch.
3. Handle the IllegalArgumentException by surfacing a 404 to the caller rather than a 500.

Example fix

// before
userDetailsService.updateUserPassword(username, newPassword); // throws if absent

// after
if (userDetailsService.getUser(username) == null) {
    return Result.failure("user not exist");
}
userDetailsService.updateUserPassword(username, newPassword);

if (userDetailsService.getUser(username) == null) {
    return Result.failure("user not exist");
}
userDetailsService.updateUserPassword(username, newPassword);

boolean userExists(NacosUserService s, String u) { return s.getUser(u) != null; }

try {
    userDetailsService.updateUserPassword(username, newPassword);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("not exist")) return notFound();
    throw e;
}

When it happens

Trigger: PUT/PATCH to update a user's password for a username that does not exist (typo, already deleted, or wrong namespace scope).

Common situations: Renaming then updating the old name; operating on a user deleted by another admin; case-sensitivity or whitespace mismatches in the username.

Related errors

• user ' + username + ' already exist!
• cannot delete admin: + username
• username is blank
• Plugin config value cannot be null: {key}
• Plugin config value must be positive: {key}

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/04be860209f17ca6. Report an issue: GitHub.