{"record":{"id":"19153d8182069312","repo":"alibaba/nacos","slug":"user-not-found-19153d","errorCode":null,"errorMessage":"user not found","messagePattern":"user not found","errorType":"exception","errorClass":"AccessException","httpStatus":401,"severity":"error","filePath":"plugin-default-impl/nacos-ldap-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/authenticate/LdapAuthenticationManager.java","lineNumber":119,"sourceCode":"        \n        UserDetails userDetails;\n        try {\n            if (!ldapLogin(username, rawPassword)) {\n                throw new AccessException(\"LDAP login failed.\");\n            }\n            userDetails =\n                userDetailsService.loadUserByUsername(AuthConstants.LDAP_PREFIX + username);\n        } catch (UsernameNotFoundException exception) {\n            String ldapUsername = AuthConstants.LDAP_PREFIX + username;\n            userDetailsService.createUser(ldapUsername, AuthConstants.LDAP_DEFAULT_ENCODED_PASSWORD,\n                false);\n            User user = new User();\n            user.setUsername(ldapUsername);\n            user.setPassword(AuthConstants.LDAP_DEFAULT_ENCODED_PASSWORD);\n            userDetails = new NacosUserDetails(user);\n        } catch (Exception e) {\n            Loggers.AUTH.error(\"[LDAP-LOGIN] failed\", e);\n            throw new AccessException(\"user not found\");\n        }\n        \n        return new NacosUser(userDetails.getUsername(),\n            jwtTokenManager.createToken(userDetails.getUsername()));\n    }\n    \n    private boolean ldapLogin(String username, String password) {\n        return ldapTemplateProvider.getLdapTemplate().authenticate(\"\",\n            new EqualsFilter(getFilterPrefix(), username).toString(), password);\n    }\n    \n    private String getFilterPrefix() {\n        LdapAuthPluginConfig config = getConfig();\n        return config == null ? filterPrefix : config.getFilterPrefix();\n    }\n    \n    private boolean isCaseSensitive() {\n        LdapAuthPluginConfig config = getConfig();","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-ldap-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/authenticate/LdapAuthenticationManager.java#L101-L137","documentation":"Thrown by LdapAuthenticationManager.authenticate inside the catch (Exception e) block that wraps the user-provisioning step. After a successful ldapLogin, the code loads or creates the LDAP-prefixed user via userDetailsService. Any unexpected exception (not UsernameNotFoundException) during that load/create is logged as [LDAP-LOGIN] failed and rethrown as a generic AccessException(\"user not found\").","triggerScenarios":"ldapLogin succeeds, but userDetailsService.loadUserByUsername or createUser throws a non-UsernameNotFound exception (e.g. database connection error, constraint violation, persistence layer failure). The catch-all converts it to AccessException.","commonSituations":"The Nacos internal database is temporarily unavailable; a duplicate-key constraint is hit during auto-provisioning of the LDAP user; the persistence layer (Derby/MySQL) has a connectivity issue.","solutions":["Check the server logs for the '[LDAP-LOGIN] failed' ERROR entry which logs the original exception 'e' — that root cause is the real problem.","Verify the internal database connectivity and that the users table is writable.","If a constraint violation appears, check for duplicate LDAP-prefixed usernames and clean up stale entries.","Resolve the underlying persistence issue, then retry the login."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    NacosUser user = ldapAuthManager.authenticate(username, rawPassword);\n} catch (AccessException e) {\n    // inspect server log for '[LDAP-LOGIN] failed' root cause before retrying\n    // do NOT retry unchanged; the persistence error will recur\n}","preventionTips":["Monitor the internal database health so provisioning failures surface before login attempts.","Keep the '[LDAP-LOGIN] failed' ERROR log searchable for quick root-cause diagnosis.","Avoid duplicate LDAP-prefixed users that can trigger constraint violations during auto-provisioning."],"tags":["auth","ldap","persistence","database","generic-catch","java"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}