apache/shenyu · error · AuthenticationException

user( ) is disabled.

Error message

user(%s) is disabled.

What it means

At ShiroRealm.doGetAuthenticationInfo:110 this AuthenticationException is thrown during dashboard JWT-token authentication when the Shiro realm has resolved the token's issuer to an existing dashboard user whose 'enabled' flag is not TRUE. It fires because the account exists but has been disabled (e.g. deactivated by an admin in the dashboard), so login must be rejected even though credentials and username are otherwise valid; the disabled flag makes ShenyuAdmin fail closed for that account.

Solutions

1. Re-enable the user in the ShenYu dashboard (user management) or set enabled=TRUE in the dashboard_user table
2. Use credentials of an enabled account for scripts/automation instead of a disabled one
3. Clear the stored token and re-login after the account is re-enabled, since old tokens are now checked per-request

Example fix

// before
UPDATE dashboard_user SET enabled = 0 WHERE user_name = 'admin';
// after
UPDATE dashboard_user SET enabled = 1 WHERE user_name = 'admin';

// check enabled flag via admin API or DB before authenticating
boolean enabled = userRepository.findByName(user).map(DashboardUser::getEnabled).orElse(false);

try { call(); } catch (AuthenticationException e) { if (e.getMessage().contains("is disabled")) { enableUserOrUseOtherAccount(); } }

When it happens

Trigger: An enabled=0 dashboard user attempts to authenticate (or holds a still-valid JWT) after an administrator disabled the account in the ShenYu dashboard user management screen.

Common situations: Offboarding: account disabled but browser session/token not cleared; shared service accounts disabled for security review; automated scripts using a user account that an admin disabled; testing with a seeded user that defaults to disabled.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• userName is null
• userName( ) can not be found.
• clientId is invalid or does not match
• token is error.
• websocket sync token is invalid

AI-assisted analysis of apache/shenyu@567142e072 (2026-09-12). Data as JSON: /api/errors/b89c808e336c5960. Report an issue: GitHub.

Appendix: source

Thrown at shenyu-admin/src/main/java/org/apache/shenyu/admin/shiro/config/ShiroRealm.java:110

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken authenticationToken) {
        String token = (String) authenticationToken.getCredentials();
        if (StringUtils.isEmpty(token)) {
            return null;
        }

        String userName = JwtUtils.getIssuer(token);
        if (StringUtils.isEmpty(userName)) {
            throw new AuthenticationException("userName is null");
        }

        DashboardUserVO dashboardUserVO = dashboardUserService.findByUserName(userName);
        if (Objects.isNull(dashboardUserVO)) {
            throw new AuthenticationException(String.format("userName(%s) can not be found.", userName));
        }
        if (!Boolean.TRUE.equals(dashboardUserVO.getEnabled())) {
            throw new AuthenticationException(String.format("user(%s) is disabled.", userName));
        }
        String clientIdFromToken = JwtUtils.getClientId(token);
        if (StringUtils.isNotEmpty(clientIdFromToken)
                && StringUtils.isNotEmpty(dashboardUserVO.getClientId())
                && !StringUtils.equals(dashboardUserVO.getClientId(), clientIdFromToken)) {
            throw new AuthenticationException("clientId is invalid or does not match");
        }

        if (!JwtUtils.verifyToken(token, jwtProperties.getSecretKey())) {
            throw new AuthenticationException("token is error.");
        }

        return new SimpleAuthenticationInfo(UserInfo.builder()
                .userName(userName)
                .userId(dashboardUserVO.getId())
                .build(), token, this.getName());
    }
}

View on GitHub (pinned to 567142e072)