apolloconfig/apollo · error · BadRequestException

Current user not found

Error message

Current user not found

What it means

HTTP 400 (BadRequestException). Thrown by NamespaceController.resolveOperator: auth type USER or USER_TOKEN but UserInfoHolder.getUser() returns null or a UserInfo with a blank userId. The operator cannot be derived because the authenticated principal was not populated. Same root cause as error 84, on the NamespaceController surface.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceController.java:406

    }
  }

  private void requireDeleteNamespacePermissionForUserToken(String appId, String env,
      String clusterName, String namespaceName) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && !unifiedPermissionValidator.hasDeleteNamespacePermission(appId, env, clusterName,
            namespaceName)) {
      throw new AccessDeniedException("Delete namespace permission is required");
    }
  }

  private String resolveOperator(String queryOperator, String payloadOperator) {
    String authType = UserIdentityContextHolder.getAuthType();
    if (UserIdentityConstants.USER.equals(authType)
        || UserIdentityConstants.USER_TOKEN.equals(authType)) {
      UserInfo loginUser = userInfoHolder.getUser();
      if (loginUser == null || StringUtils.isBlank(loginUser.getUserId())) {
        throw new BadRequestException("Current user not found");
      }
      return loginUser.getUserId();
    }

    if (UserIdentityConstants.CONSUMER.equals(authType)) {
      String operator = StringUtils.isBlank(queryOperator) ? payloadOperator : queryOperator;
      RequestPrecondition.checkArguments(!StringUtils.isContainEmpty(operator),
          "operator should not be null or empty");
      if (userService.findByUserId(operator) == null) {
        throw BadRequestException.userNotExists(operator);
      }
      return operator;
    }

    throw new BadRequestException("Unsupported auth type: %s", authType);
  }
}

View on GitHub (pinned to d95fc18d11)

Solutions

  1. Re-authenticate to obtain a fresh session/user-token and retry.
  2. Fix the auth integration so UserInfoHolder is populated with a non-blank userId for USER/USER_TOKEN.
  3. Authenticate as CONSUMER and pass an explicit operator if using OpenAPI.
  4. Verify security filter ordering places principal population before the controller.

Example fix

// before: USER auth but principal missing
UserInfo u = userInfoHolder.getUser(); // null -> 400

// after: auth filter sets principal, or switch auth type
client.withConsumerToken(openApiToken).createNamespace(appId, env, cluster, dto, operator="svcacct");
Defensive patterns

Strategy: try-catch

Validate before calling

// For USER/USER_TOKEN: ensure principal exists before any namespace write.
UserInfo u = userInfoHolder.getUser();
if (u == null || StringUtils.isBlank(u.getUserId())) { /* re-authenticate */ }

Type guard

null

Try / catch

try {
  client.createNamespace(appId, env, cluster, dto);
} catch (HttpClientErrorException.BadRequest e) {
  if (e.getResponseBodyAsString().contains("Current user not found")) {
    refreshToken(); client.createNamespace(appId, env, cluster, dto);
  }
}

Prevention

When it happens

Trigger: Any NamespaceController mutating API (create/update/delete namespace) authenticated as USER/USER_TOKEN where the security principal is missing or has a blank userId at controller time.

Common situations: Portal SSO session expired mid-request; user-token authenticated but did not resolve to a UserInfo; custom auth filter sets authType=USER without populating UserInfoHolder; gateway stripped auth headers.

Related errors

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/0858af3f685f7dab. Report an issue: GitHub.