alibaba/nacos · warning · IllegalArgumentException

user '{username}' not found!

Error message

user '{username}' not found!

What it means

Thrown by NacosRoleServiceDirectImpl.addRole(role, username) when binding a role to a user that does not exist in the user store. The service calls userDetailsService.getUser(username); a null return means no such user is persisted, so the role binding is rejected before touching the database. It is an IllegalArgumentException, so it surfaces to the caller as a 400-style validation failure, not a server error.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/roles/NacosRoleServiceDirectImpl.java:126

            }
        }
        return permissionInfoList;
    }
    
    @Override
    public Page<PermissionInfo> getPermissions(String role, int pageNo, int pageSize) {
        Page<PermissionInfo> pageInfo =
            permissionPersistService.getPermissions(role, pageNo, pageSize);
        if (pageInfo == null) {
            return new Page<>();
        }
        return pageInfo;
    }
    
    @Override
    public void addRole(String role, String username) {
        if (userDetailsService.getUser(username) == null) {
            throw new IllegalArgumentException("user '" + username + "' not found!");
        }
        
        if (AuthConstants.GLOBAL_ADMIN_ROLE.equals(role)) {
            throw new IllegalArgumentException(
                "role '" + AuthConstants.GLOBAL_ADMIN_ROLE + "' is not permitted to create!");
        }
        
        if (AuthConstants.ANONYMOUS_ROLE.equals(role)) {
            throw new IllegalArgumentException(
                "role '" + AuthConstants.ANONYMOUS_ROLE + "' is reserved by the system");
        }
        
        if (isUserBoundToRole(role, username)) {
            throw new IllegalArgumentException(
                "user '" + username + "' already bound to the role '" + role + "'!");
        }
        
        rolePersistService.addRole(role, username);

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Create the user first (POST /v3/admin/auth/user or userService.createUser) before assigning the role.
2. Verify the exact username with GET /v3/admin/auth/user?username=<value>, matching case.
3. If the user was recently deleted, re-create it, then retry the role binding.
4. In clustered setups, ensure user creation has replicated to the node handling the addRole call.

Example fix

// before
roleService.addRole("ROLE_DEV", "alice"); // throws if alice missing

// after
if (userService.getUser("alice") == null) {
    userService.createUser("alice", password);
}
roleService.addRole("ROLE_DEV", "alice");

// Verify the user exists before binding a role.
if (userDetailsService.getUser(username) == null) {
    throw new IllegalStateException("Cannot bind role: user '" + username + "' does not exist");
}
roleService.addRole(role, username);

When it happens

Trigger: POST /v3/admin/auth/role (or console equivalent) with a 'username' parameter for a user that was never created, was deleted, or is misspelled. Also triggered programmatically via NacosRoleService.addRole after a user was removed in another node and the local cache is stale.

Common situations: Creating a role assignment before creating the user; case-sensitivity mismatch on the username; referencing a user that was just deleted by another admin; scripts that provision roles and users out of order.

Related errors

• role 'ROLE_ADMIN' is not permitted to create!
• role '__nacos_anonymous_role__' is reserved by the system
• role {role} not found!
• username '__nacos_anonymous__' is reserved by the system
• username is blank

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/a1f595c2d721fa92. Report an issue: GitHub.