{"record":{"id":"46251dfbf50c7e9c","repo":"alibaba/arthas","slug":"error-command-not-permitted-try-to-use-auth-co","errorCode":null,"errorMessage":"Error! command not permitted, try to use 'auth' command to authenticates.","messagePattern":"Error! command not permitted, try to use 'auth' command to authenticates\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/com/taobao/arthas/core/shell/system/impl/JobControllerImpl.java","lineNumber":74,"sourceCode":"\n    public synchronized Job getJob(int id) {\n        return jobs.get(id);\n    }\n\n    synchronized boolean removeJob(int id) {\n        return jobs.remove(id) != null;\n    }\n\n    private void checkPermission(Session session, CliToken token) {\n        if (ArthasBootstrap.getInstance().getSecurityAuthenticator().needLogin()) {\n            // 检查session是否有 Subject\n            Object subject = session.get(ArthasConstants.SUBJECT_KEY);\n            if (subject == null) {\n                if (token != null && token.isText() && token.value().trim().equals(ArthasConstants.AUTH)) {\n                    // 执行的是auth 命令\n                    return;\n                }\n                throw new IllegalArgumentException(\"Error! command not permitted, try to use 'auth' command to authenticates.\");\n            }\n        }\n    }\n\n    @Override\n    public Job createJob(InternalCommandManager commandManager, List<CliToken> tokens, Session session, JobListener jobHandler, Term term, ResultDistributor resultDistributor) {\n        checkPermission(session, tokens.get(0));\n        int jobId = idGenerator.incrementAndGet();\n        StringBuilder line = new StringBuilder();\n        for (CliToken arg : tokens) {\n            line.append(arg.raw());\n        }\n        boolean runInBackground = runInBackground(tokens);\n        Process process = createProcess(session, tokens, commandManager, jobId, term, resultDistributor);\n        process.setJobId(jobId);\n        JobImpl job = new JobImpl(jobId, this, process, line.toString(), runInBackground, session, jobHandler);\n        jobs.put(jobId, job);\n        return job;","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/alibaba/arthas/blob/21cf2e9ba52b305290be7223b980ff504bb9cb5b/core/src/main/java/com/taobao/arthas/core/shell/system/impl/JobControllerImpl.java#L56-L92","documentation":"Thrown by JobControllerImpl.checkPermission when a SecurityAuthenticator is configured to require login (needLogin() returns true) but the session carries no authenticated Subject and the command being issued is not the 'auth' command itself. This is Arthas' command-level authorization gate for the shell.","triggerScenarios":"A user opens a telnet/http session and types any diagnostic command (e.g. 'trace', 'watch') before running 'auth <password>'. The SecurityAuthenticator was enabled via -Darthas.authToken or arthas.properties, so every non-auth command is blocked until login.","commonSituations":"Production deployments that secure Arthas with a token. Forgetting to authenticate after connecting via telnet or the web console. Automation scripts that open a session but skip the auth step.","solutions":["Run 'auth <your-token>' as the first command in the session, where the token matches arthas.properties 'arthas.authToken' or the --auth-token flag.","Disable authentication for local debugging by removing the authToken configuration.","In HTTP API workflows, pass the Authorization header (configured auth) so the session is pre-authenticated.","Verify the token value matches exactly — a wrong token silently leaves subject null."],"exampleFix":"$ telnet 127.0.0.1 3658\n# before:\ntrace com.example.Service hello\n# -> Error! command not permitted, try to use 'auth' command to authenticates.\n\n# after:\nauth mySecretToken\ntrace com.example.Service hello","handlingStrategy":"validation","validationCode":"// Before issuing commands, check if auth is needed and whether session is authenticated\nif (ArthasBootstrap.getInstance().getSecurityAuthenticator().needLogin()) {\n    Object subject = session.get(ArthasConstants.SUBJECT_KEY);\n    if (subject == null) {\n        // send 'auth <token>' first\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always run 'auth <token>' as the first command when authentication is configured.","Store the token securely and inject it in automation scripts.","For HTTP API, pass the Authorization header to pre-authenticate the session."],"tags":["authentication","authorization","security","session"],"backgroundTag":null,"analyzedSha":"21cf2e9ba52b305290be7223b980ff504bb9cb5b","analyzedAt":"2026-08-14T00:57:07.243Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}