{"record":{"id":"0efdc820f4a7bbb6","repo":"alibaba/nacos","slug":"role-nacos-anonymous-role-is-reserved-by-the-0efdc8","errorCode":null,"errorMessage":"role '__nacos_anonymous_role__' is reserved by the system","messagePattern":"role '__nacos_anonymous_role__' is reserved by the system","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"warning","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/roles/NacosRoleServiceRemoteImpl.java","lineNumber":174,"sourceCode":"            throw new NacosRuntimeException(NacosException.SERVER_ERROR,\n                unpectedException.getMessage());\n        }\n    }\n    \n    @Override\n    public List<RoleInfo> getAllRoles() {\n        return getRoles(StringUtils.EMPTY, StringUtils.EMPTY, DEFAULT_PAGE_NO, Integer.MAX_VALUE)\n            .getPageItems();\n    }\n    \n    @Override\n    public void addRole(String role, String username) {\n        if (AuthConstants.GLOBAL_ADMIN_ROLE.equals(role)) {\n            throw new IllegalArgumentException(\n                \"role '\" + AuthConstants.GLOBAL_ADMIN_ROLE + \"' is not permitted to create!\");\n        }\n        if (AuthConstants.ANONYMOUS_ROLE.equals(role)) {\n            throw new IllegalArgumentException(\n                \"role '\" + AuthConstants.ANONYMOUS_ROLE + \"' is reserved by the system\");\n        }\n        Map<String, String> body = Map.of(\"role\", role, \"username\", username);\n        try {\n            HttpRestResult<String> httpResult = nacosRestTemplate.postForm(\n                buildRemoteRoleUrlPath(AuthConstants.ROLE_PATH),\n                RemoteServerUtil.buildServerRemoteHeader(), body, String.class);\n            RemoteServerUtil.singleCheckResult(httpResult);\n            getCachedRoleSet().add(role);\n            invalidateUserRoles(username);\n        } catch (NacosException e) {\n            throw new NacosRuntimeException(e.getErrCode(), e.getErrMsg());\n        } catch (Exception unpectedException) {\n            throw new NacosRuntimeException(NacosException.SERVER_ERROR,\n                unpectedException.getMessage());\n        }\n    }\n    ","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/roles/NacosRoleServiceRemoteImpl.java#L156-L192","documentation":"Thrown by the remote addRole when the role name equals ANONYMOUS_ROLE (\"__nacos_anonymous_role__\"). Mirrors the direct impl guard: the anonymous role is system-managed and cannot be created through the public API. The check is local on the console node, so no remote request is issued.","triggerScenarios":"Console-side addRole(\"__nacos_anonymous_role__\", username); importing a role set containing the anonymous role via the remote path.","commonSituations":"Bulk role import without reserved-name filtering; misconfigured sync job replaying default roles.","solutions":["Exclude __nacos_anonymous_role__ from role lists fed to addRole.","Manage anonymous access via authorization configuration, not role creation.","Add a reserved-name blocklist in your provisioning code."],"exampleFix":"// before\nroles.forEach(r -> roleService.addRole(r, username)); // fails on anonymous\n\n// after\nSet<String> reserved = Set.of(\"ROLE_ADMIN\", \"__nacos_anonymous_role__\");\nroles.stream().filter(r -> !reserved.contains(r))\n     .forEach(r -> roleService.addRole(r, username));","handlingStrategy":"validation","validationCode":"Set<String> reserved = Set.of(AuthConstants.GLOBAL_ADMIN_ROLE, AuthConstants.ANONYMOUS_ROLE);\nif (!reserved.contains(role)) {\n    roleService.addRole(role, username);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Block reserved role names before calling addRole.","Do not recreate system-managed roles via the public API.","Configure anonymous behavior rather than recreating the role."],"tags":["auth","role","reserved","anonymous","remote"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}