{"record":{"id":"0da3b8b7ac7d2ebf","repo":"alibaba/nacos","slug":"user-not-found-0da3b8","errorCode":null,"errorMessage":"user not found!","messagePattern":"user not found!","errorType":"exception","errorClass":"AccessException","httpStatus":401,"severity":"error","filePath":"plugin-default-impl/nacos-ldap-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/authenticate/LdapAuthenticationManager.java","lineNumber":83,"sourceCode":"        this.filterPrefix = filterPrefix;\n        this.caseSensitive = caseSensitive;\n        this.configProvider = null;\n    }\n    \n    public LdapAuthenticationManager(LdapTemplateProvider ldapTemplateProvider,\n        NacosUserService userDetailsService, TokenManagerDelegate jwtTokenManager,\n        NacosRoleService roleService, LdapAuthPluginConfigProvider configProvider) {\n        super(userDetailsService, jwtTokenManager, roleService);\n        this.ldapTemplateProvider = ldapTemplateProvider;\n        this.filterPrefix = null;\n        this.caseSensitive = true;\n        this.configProvider = configProvider;\n    }\n    \n    @Override\n    public NacosUser authenticate(String username, String rawPassword) throws AccessException {\n        if (StringUtils.isBlank(username)) {\n            throw new AccessException(\"user not found!\");\n        }\n        \n        if (!isCaseSensitive()) {\n            username = username.toLowerCase();\n        }\n        \n        if (username.toUpperCase().startsWith(AuthConstants.LDAP_PREFIX)) {\n            throw new AccessException(\"user not found!\");\n        }\n        \n        try {\n            return super.authenticate(username, rawPassword);\n        } catch (AccessException | UsernameNotFoundException ignored) {\n            if (Loggers.AUTH.isWarnEnabled()) {\n                Loggers.AUTH.warn(\"try login with LDAP, user: {}\", username);\n            }\n        }\n        ","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-ldap-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/authenticate/LdapAuthenticationManager.java#L65-L101","documentation":"Thrown by LdapAuthenticationManager.authenticate when the username parameter is blank. The LDAP authentication flow cannot query a directory server without a username, so it rejects the request immediately with AccessException(\"user not found!\") rather than attempting a bind. This is the first guard in the authenticate method.","triggerScenarios":"Calling authenticate(username, rawPassword) where username is null, empty, or whitespace-only. Triggered by a login API (HTTP or gRPC) that forwards an empty username field to the LDAP auth manager.","commonSituations":"A login form or API client sends an empty username; an automated SSO/token-exchange path calls authenticate with a null identifier extracted from a JWT claim that was missing.","solutions":["Ensure the login endpoint validates that username is non-blank before invoking the LDAP authentication manager.","Return a 400 Bad Request with a clear message when the client omits the username.","If the caller extracts the username from a token/claim, verify the claim exists before authentication."],"exampleFix":"// before\nNacosUser user = ldapAuthManager.authenticate(username, rawPassword);\n\n// after\nif (StringUtils.isBlank(username)) {\n    throw new AccessException(\"user not found!\");\n}\nNacosUser user = ldapAuthManager.authenticate(username, rawPassword);","handlingStrategy":"validation","validationCode":"if (StringUtils.isBlank(username)) {\n    throw new AccessException(\"user not found!\");\n}\nNacosUser user = ldapAuthManager.authenticate(username, rawPassword);","typeGuard":"static boolean isValidLoginUsername(String username) {\n    return username != null && !username.trim().isEmpty();\n}","tryCatchPattern":"try {\n    NacosUser user = ldapAuthManager.authenticate(username, rawPassword);\n} catch (AccessException e) {\n    // map to 401 Unauthorized; do not leak whether user exists\n}","preventionTips":["Validate username and password are non-blank in the login controller before invoking the auth manager.","Return generic auth-failure messages to avoid user-enumeration hints.","Log the missing-username case at WARN for monitoring without exposing it to the client."],"tags":["auth","ldap","validation","access-denied","java"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}