{"record":{"id":"1a72b064403872d2","repo":"apache/incubator-seata","slug":"no-right-to-be-identified","errorCode":null,"errorMessage":"No right to be identified","messagePattern":"No right to be identified","errorType":"exception","errorClass":"AuthenticationFailedException","httpStatus":401,"severity":"error","filePath":"console/src/main/java/org/apache/seata/mcp/service/impl/ConsoleRemoteServiceImpl.java","lineNumber":81,"sourceCode":"\n    private final NamingServerProperties namingServerProperties;\n\n    public ConsoleRemoteServiceImpl(\n            JwtTokenUtils jwtTokenUtils,\n            @Qualifier(\"consoleRestClient\") RestClient restClient,\n            ObjectMapper objectMapper,\n            NamingServerProperties namingServerProperties) {\n        this.jwtTokenUtils = jwtTokenUtils;\n        this.restClient = restClient;\n        this.objectMapper = objectMapper;\n        this.namingServerProperties = namingServerProperties;\n        LOGGER.info(\"ConsoleRemoteServiceImpl initialized.\");\n    }\n\n    public String getToken() {\n        Authentication auth = SecurityContextHolder.getContext().getAuthentication();\n        if (auth == null || !auth.isAuthenticated()) {\n            throw new AuthenticationFailedException(\"No right to be identified\");\n        }\n        String originJwt = (String) auth.getCredentials();\n        if (!jwtTokenUtils.validateToken(originJwt)) {\n            throw new AuthenticationFailedException(\"Invalid token, please log in to get a new token\");\n        }\n        return WebSecurityConfig.TOKEN_PREFIX + originJwt;\n    }\n\n    public void setNamespaceHeaderAndQueryParam(\n            NameSpaceDetail nameSpaceDetail, HttpHeaders headers, Map<String, String> queryParams) {\n        headers.add(\"x-seata-namespace\", nameSpaceDetail.getNamespace());\n        if (StringUtils.isNotBlank(nameSpaceDetail.getvGroup())) {\n            if (queryParams != null) {\n                queryParams.put(\"vGroup\", nameSpaceDetail.getvGroup());\n            }\n            return;\n        }\n        if (nameSpaceDetail.getCluster() != null) {","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/apache/incubator-seata/blob/e01f97c6db397165050caa6764020410c2c8199a/console/src/main/java/org/apache/seata/mcp/service/impl/ConsoleRemoteServiceImpl.java#L63-L99","documentation":"ConsoleRemoteServiceImpl.getToken throws AuthenticationFailedException when SecurityContextHolder yields no Authentication or an unauthenticated one. The console's remote calls (to naming server / TC instances) forward the caller's JWT; without an authenticated security context there is no credential to forward, so the call is refused.","triggerScenarios":"Invoking any MCP/console remote operation (getCallNameSpace, getCallTC, deleteCallTC, putCallTC...) in a session where the user never logged in, the security context was cleared (e.g. async thread without context propagation), or the request bypassed the JWT filter chain.","commonSituations":"Calling MCP endpoints unauthenticated, token expiry causing the filter to skip setting Authentication, executing remote calls on a background/scheduled thread where SecurityContextHolder is not propagated, or misordered security filter config letting requests through without auth.","solutions":["Authenticate first: log in via the console to obtain a JWT so requests carry the Bearer token","If invoking programmatically, pass a valid token so the security filter establishes the Authentication","When calling from non-request threads, propagate the security context (DelegatingSecurityContextExecutor) or fetch the token explicitly rather than relying on the holder","Check WebSecurityConfig filter order if valid tokens still yield no Authentication"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { String token = service.getToken(); } catch (AuthenticationFailedException e) { return http401(e.getMessage()); }","preventionTips":["Authenticate and attach the JWT before any console/MCP remote call","Propagate SecurityContextHolder to any background threads making remote calls","Centralize token acquisition in one component so all remote paths share the guard"],"tags":["seata","console","authentication","jwt"],"backgroundTag":null,"analyzedSha":"e01f97c6db397165050caa6764020410c2c8199a","analyzedAt":"2026-08-14T10:23:53.097Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}