{"record":{"id":"917e31cc7988c6fb","repo":"alibaba/nacos","slug":"e-geterrmsg-917e31","errorCode":null,"errorMessage":"e.getErrMsg()","messagePattern":"e\\.getErrMsg\\(\\)","errorType":"exception","errorClass":"NacosRuntimeException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/users/NacosUserServiceRemoteImpl.java","lineNumber":77,"sourceCode":"    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {\n        User user = getUser(username);\n        if (null == user) {\n            throw new UsernameNotFoundException(String.format(\"User %s not found\", username));\n        }\n        return new NacosUserDetails(user);\n    }\n    \n    @Override\n    public void updateUserPassword(String username, String password) {\n        Query query = Query.newInstance().addParam(\"username\", username);\n        Map<String, String> body = Map.of(\"newPassword\", password);\n        try {\n            HttpRestResult<String> result = nacosRestTemplate.putForm(\n                buildRemoteUserUrlPath(AuthConstants.USER_PATH),\n                RemoteServerUtil.buildServerRemoteHeader(), query, body, String.class);\n            RemoteServerUtil.singleCheckResult(result);\n        } catch (NacosException e) {\n            throw new NacosRuntimeException(e.getErrCode(), e.getErrMsg());\n        } catch (Exception unpectedException) {\n            throw new NacosRuntimeException(NacosException.SERVER_ERROR,\n                unpectedException.getMessage());\n        }\n    }\n    \n    @Override\n    public Page<User> getUsers(int pageNo, int pageSize, String username) {\n        Query query = Query.newInstance().addParam(\"username\", username).addParam(\"pageNo\", pageNo)\n            .addParam(\"pageSize\", pageSize).addParam(\"search\", \"accurate\");\n        return getUserPageFromRemote(query);\n    }\n    \n    @Override\n    public Page<User> findUsers(String username, int pageNo, int pageSize) {\n        Query query = Query.newInstance().addParam(\"username\", username).addParam(\"pageNo\", pageNo)\n            .addParam(\"pageSize\", pageSize).addParam(\"search\", \"blur\");\n        return getUserPageFromRemote(query);","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/users/NacosUserServiceRemoteImpl.java#L59-L95","documentation":"The recognized-failure branch of updateUserPassword: the PUT .../user password update is proxied to a peer Nacos server, and either the HTTP transport raised a NacosException or singleCheckResult saw a non-OK result. The peer's original errCode and message pass through unchanged (e.g. 403 forbidden, 400 weak password).","triggerScenarios":"Updating a password when the peer returns 403 (server-identity header mismatch), 400 (new password rejected by server-side policy or user not found), or a transport timeout/connection error.","commonSituations":"server.identity.key/value not aligned between console and server; password policy on the peer rejecting the new value; peer node down during a password-rotation workflow.","solutions":["Map the propagated errCode: 403 -> align server-identity header; 400 -> meet the password policy; 5xx -> peer fault, check peer logs.","Verify the username exists on the peer before updating.","Retry once on transient transport errors (timeout, reset).","Confirm the peer is reachable from cluster.conf."],"exampleFix":"// before\nuserService.updateUserPassword(username, newPassword);\n\n// after\ntry {\n    userService.updateUserPassword(username, newPassword);\n} catch (NacosRuntimeException e) {\n    if (e.getErrCode() == 400) {\n        return Result.failure(400, \"password rejected by policy: \" + e.getMessage());\n    }\n    if (e.getErrCode() == 403) {\n        log.error(\"server-identity header rejected by peer\");\n    }\n    throw e;\n}","handlingStrategy":"try-catch","validationCode":"// Pre-flight: confirm server-identity header and username before updating.\nvar cfg = NacosAuthConfigHolder.getInstance().getNacosAuthConfigByScope(ApiType.OPEN_API.name());\nif (cfg != null && StringUtils.isBlank(cfg.getServerIdentityKey())) {\n    log.warn(\"server-identity blank; password update may be 403'd by peer\");\n}\nif (userService.getUser(username) == null) {\n    throw new IllegalArgumentException(\"cannot update password: user not found \" + username);\n}","typeGuard":null,"tryCatchPattern":"try {\n    userService.updateUserPassword(username, newPassword);\n} catch (NacosRuntimeException e) {\n    switch (e.getErrCode()) {\n        case 400: return Result.failure(400, \"password rejected: \" + e.getMessage());\n        case 403: log.error(\"server-identity rejected by peer\"); break;\n        default:  log.error(\"password update failed: code={} msg={}\", e.getErrCode(), e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Align server-identity key/value across nodes to avoid 403.","Confirm the user exists before updating.","Satisfy the peer's password policy on the client side.","Retry transient transport errors once."],"tags":["auth","user-management","remote","password","http"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}