{"record":{"id":"cf3f90113b46fc14","repo":"apache/shenyu","slug":"username-s-can-not-be-found","errorCode":null,"errorMessage":"userName(%s) can not be found.","messagePattern":"userName\\((.+?)\\) can not be found\\.","errorType":"exception","errorClass":"AuthenticationException","httpStatus":401,"severity":"error","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/shiro/config/ShiroRealm.java","lineNumber":107,"sourceCode":"        }\n        return super.isPermitted(permission, info);\n    }\n\n    @Override\n    protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken authenticationToken) {\n        String token = (String) authenticationToken.getCredentials();\n        if (StringUtils.isEmpty(token)) {\n            return null;\n        }\n\n        String userName = JwtUtils.getIssuer(token);\n        if (StringUtils.isEmpty(userName)) {\n            throw new AuthenticationException(\"userName is null\");\n        }\n\n        DashboardUserVO dashboardUserVO = dashboardUserService.findByUserName(userName);\n        if (Objects.isNull(dashboardUserVO)) {\n            throw new AuthenticationException(String.format(\"userName(%s) can not be found.\", userName));\n        }\n        if (!Boolean.TRUE.equals(dashboardUserVO.getEnabled())) {\n            throw new AuthenticationException(String.format(\"user(%s) is disabled.\", userName));\n        }\n        String clientIdFromToken = JwtUtils.getClientId(token);\n        if (StringUtils.isNotEmpty(clientIdFromToken)\n                && StringUtils.isNotEmpty(dashboardUserVO.getClientId())\n                && !StringUtils.equals(dashboardUserVO.getClientId(), clientIdFromToken)) {\n            throw new AuthenticationException(\"clientId is invalid or does not match\");\n        }\n\n        if (!JwtUtils.verifyToken(token, jwtProperties.getSecretKey())) {\n            throw new AuthenticationException(\"token is error.\");\n        }\n\n        return new SimpleAuthenticationInfo(UserInfo.builder()\n                .userName(userName)\n                .userId(dashboardUserVO.getId())","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/shiro/config/ShiroRealm.java#L89-L125","documentation":"ShiroRealm authenticates the JWT's issuer as a dashboard user name; if dashboardUserService.findByUserName(userName) returns null, no such dashboard user exists in the admin database and an AuthenticationException naming the user is thrown.","triggerScenarios":"The JWT has a valid issuer claim but no DashboardUser row with that userName exists — e.g. the user was deleted from the dashboard, the token was issued by a different admin instance/database, or the H2/MySQL DB was reset while old tokens are still in use.","commonSituations":"Admin database re-initialized (db/init scripts rerun) while browsers keep old tokens; multi-environment setups sharing tokens between dev/prod admin instances; user renamed via direct DB edits; stale tokens after user deletion.","solutions":["Log in again to get a token issued for an existing dashboard user","Verify the user exists: query the dashboard_user table for the userName in the error message","If the DB was reset, recreate the dashboard user before reusing old tokens","Check that the admin instance the client targets is the one that issued the token (same database)"],"exampleFix":"// before\nDELETE FROM dashboard_user WHERE user_name = 'admin';\n// after\n-- recreate or re-enable the user instead of deleting while sessions are active\nINSERT INTO dashboard_user (user_name, password, enabled) VALUES ('admin', '{bcrypt}...', TRUE);","handlingStrategy":"validation","validationCode":"// confirm the user exists before using a token\nboolean userExists = adminApi.userExists(issuerFromToken);","typeGuard":null,"tryCatchPattern":"try { call(); } catch (AuthenticationException e) { if (e.getMessage().endsWith(\"can not be found.\")) { relogin(); } }","preventionTips":["Recreate dashboard users after DB resets before reusing clients","Avoid direct DB renames/deletes of dashboard_user rows while tokens are active","Keep one admin database per environment; do not share tokens across environments"],"tags":["jwt","authentication","user-not-found","admin"],"backgroundTag":"user-not-found","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}