{"record":{"id":"cbe75d7657084137","repo":"alibaba/nacos","slug":"role-nacos-anonymous-role-is-reserved-by-the-cbe75d","errorCode":null,"errorMessage":"role '__nacos_anonymous_role__' is reserved by the system","messagePattern":"role '__nacos_anonymous_role__' is reserved by the system","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"warning","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/roles/NacosRoleServiceDirectImpl.java","lineNumber":135,"sourceCode":"        if (pageInfo == null) {\n            return new Page<>();\n        }\n        return pageInfo;\n    }\n    \n    @Override\n    public void addRole(String role, String username) {\n        if (userDetailsService.getUser(username) == null) {\n            throw new IllegalArgumentException(\"user '\" + username + \"' not found!\");\n        }\n        \n        if (AuthConstants.GLOBAL_ADMIN_ROLE.equals(role)) {\n            throw new IllegalArgumentException(\n                \"role '\" + AuthConstants.GLOBAL_ADMIN_ROLE + \"' is not permitted to create!\");\n        }\n        \n        if (AuthConstants.ANONYMOUS_ROLE.equals(role)) {\n            throw new IllegalArgumentException(\n                \"role '\" + AuthConstants.ANONYMOUS_ROLE + \"' is reserved by the system\");\n        }\n        \n        if (isUserBoundToRole(role, username)) {\n            throw new IllegalArgumentException(\n                \"user '\" + username + \"' already bound to the role '\" + role + \"'!\");\n        }\n        \n        rolePersistService.addRole(role, username);\n        getCachedRoleSet().add(role);\n        invalidateUserRoles(username);\n    }\n    \n    @Override\n    public void addAdminRole(String username) {\n        if (userDetailsService.getUser(username) == null) {\n            throw new IllegalArgumentException(\"user '\" + username + \"' not found!\");\n        }","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/roles/NacosRoleServiceDirectImpl.java#L117-L153","documentation":"Thrown by addRole when the role name equals AuthConstants.ANONYMOUS_ROLE (\"__nacos_anonymous_role__\"). That role is an internal system role used for unauthenticated/anonymous access mapping and is provisioned by the system itself; it cannot be created through the public role API. The check protects the internal anonymous permission set from being overwritten.","triggerScenarios":"Calling addRole(\"__nacos_anonymous_role__\", username); importing an external role catalog that includes the anonymous role; a misconfigured role-sync job feeding literal reserved names.","commonSituations":"Bulk role import without a reserved-name blocklist; tools or Helm charts that attempt to recreate every default role; misunderstanding that the anonymous role is system-managed.","solutions":["Remove __nacos_anonymous_role__ (and ROLE_ADMIN) from any role list you feed to addRole.","Manage anonymous access through the system's authorization config, not by recreating the role.","Add a guard that rejects role names matching AuthConstants.ANONYMOUS_ROLE before calling the API."],"exampleFix":"// before\nfor (String r : roles) roleService.addRole(r, username); // blows up on anonymous\n\n// after\nSet<String> reserved = Set.of(\"ROLE_ADMIN\", \"__nacos_anonymous_role__\");\nroles.stream().filter(r -> !reserved.contains(r))\n     .forEach(r -> roleService.addRole(r, username));","handlingStrategy":"validation","validationCode":"Set<String> reserved = Set.of(AuthConstants.GLOBAL_ADMIN_ROLE, AuthConstants.ANONYMOUS_ROLE);\nif (reserved.contains(role)) {\n    throw new IllegalArgumentException(\"Refusing to create reserved system role: \" + role);\n}\nroleService.addRole(role, username);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Maintain a reserved-role blocklist and check it before addRole.","Do not attempt to recreate system-managed roles.","Manage anonymous/admin behavior through config, not role creation."],"tags":["auth","role","validation","reserved","anonymous"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}