apolloconfig/apollo · warning · AccessDeniedException

Access is denied

Error message

Access is denied

What it means

Thrown by ClusterController.requireDeleteClusterPermission as the final fallthrough when the authType in UserIdentityContextHolder does not match any of USER, CONSUMER, or USER_TOKEN (e.g. it is ANONYMOUS or null). This indicates the request reached the controller without a recognized authentication identity being set on the thread-local context. Maps to HTTP 403 AccessDeniedException.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/ClusterController.java:128

        return;
      }
      throw new AccessDeniedException("Super admin permission is required");
    }
    if (UserIdentityConstants.CONSUMER.equals(authType)) {
      // Existing OpenAPI consumers use app-scoped authorization here. Preserve that public
      // token boundary while keeping the Portal USER path compatible with the legacy WebAPI.
      if (unifiedPermissionValidator.isAppAdmin(appId)) {
        return;
      }
      throw new AccessDeniedException("App admin permission is required");
    }
    if (UserIdentityConstants.USER_TOKEN.equals(authType)) {
      if (unifiedPermissionValidator.isSuperAdmin()) {
        return;
      }
      throw new AccessDeniedException("Super admin permission is required");
    }
    throw new AccessDeniedException("Access is denied");
  }

  private void requireReadApplicationPermissionForUserToken(String appId) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && !unifiedPermissionValidator.hasReadApplicationPermission(appId)) {
      throw new AccessDeniedException("Access is denied");
    }
  }

  private void requireCreateClusterPermissionForUserToken(String appId, String env,
      String clusterName) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && !unifiedPermissionValidator.hasCreateClusterPermission(appId, env, clusterName)) {
      throw new AccessDeniedException("Create cluster permission is required");
    }
  }

  private String resolveOperator(String operator) {

View on GitHub (pinned to d95fc18d11)

Solutions

1. Verify the request includes proper authentication (token header or session cookie) and that the auth filter is active.
2. Check the authentication interceptor configuration to ensure UserIdentityContextHolder.setAuthType() is called with one of USER, CONSUMER, USER_TOKEN.
3. If a new auth type was introduced, update requireDeleteClusterPermission to handle it explicitly.

// This error indicates a misconfigured auth pipeline — catch and surface a clear diagnostic
try {
    client.delete("/openapi/v1/envs/" + env + "/apps/" + appId + "/clusters/" + clusterName);
} catch (AccessDeniedException e) {
    // Investigate why authType was not set — this is a server-side config issue
    logger.error("Auth type not recognized for delete-cluster. Check security filter configuration.", e);
    throw new IllegalStateException("Server auth configuration error: authType not set. Contact the platform team.", e);
}

When it happens

Trigger: DELETE /openapi/v1/envs/{env}/apps/{appId}/clusters/{clusterName} where the authentication filter did not populate UserIdentityContextHolder with a known type — e.g. an ANONYMOUS request bypassing the filter, or a misconfigured auth interceptor that failed to set the auth type.

Common situations: A misconfigured security filter chain or a custom authentication interceptor that does not call UserIdentityContextHolder.setAuthType(). Can also occur during local development if the OpenAPI auth filter is disabled or bypassed, or after upgrading Apollo where a new auth type constant was introduced but the delete-permission method was not updated to handle it.

Related errors

• Super admin permission is required
• App admin permission is required
• Create cluster permission is required
• Metadata read permission is required
• Access is denied

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/4ea061765402bbe3. Report an issue: GitHub.