apolloconfig/apollo · error · BadRequestException

Unsupported auth type: %s

Error message

Unsupported auth type: %s

What it means

HTTP 400 (BadRequestException). Thrown by OpenApiOperatorResolver.resolve when UserIdentityContextHolder.getAuthType() is not USER, USER_TOKEN, or CONSUMER (e.g. ANONYMOUS, null, or an unrecognized value). The resolver cannot determine how to obtain the operator. Same root cause as errors 85/93, centralized in the shared resolver.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/OpenApiOperatorResolver.java:63

        || UserIdentityConstants.USER_TOKEN.equals(authType)) {
      UserInfo loginUser = userInfoHolder.getUser();
      if (loginUser == null || !StringUtils.hasText(loginUser.getUserId())) {
        throw new BadRequestException("Current user not found");
      }
      return loginUser.getUserId();
    }

    if (UserIdentityConstants.CONSUMER.equals(authType)) {
      if (!StringUtils.hasText(operator)) {
        throw new BadRequestException("operator should not be null or empty");
      }
      if (userService.findByUserId(operator) == null) {
        throw BadRequestException.userNotExists(operator);
      }
      return operator;
    }

    throw new BadRequestException("Unsupported auth type: %s", authType);
  }
}

View on GitHub (pinned to d95fc18d11)

Solutions

1. Authenticate with a supported mechanism (portal SSO -> USER, user-token -> USER_TOKEN, OpenAPI token -> CONSUMER).
2. Fix the security filter chain to set authType for every authenticated request.
3. Reject anonymous/unknown authType before reaching the controller.
4. Ensure the constant matches exactly 'USER'/'USER_TOKEN'/'CONSUMER'.

Example fix

// before: authType = ANONYMOUS -> 400
resolver.resolve("alice");

// after: authenticate as CONSUMER
client.withConsumerToken(token).someWrite(operator="alice");

// Ensure a recognized auth type before resolving the operator.
String authType = UserIdentityContextHolder.getAuthType();
if (!Set.of("USER","USER_TOKEN","CONSUMER").contains(authType)) { /* authenticate */ }

null

try {
  client.someWrite(appId, payload);
} catch (HttpClientErrorException.BadRequest e) {
  if (e.getResponseBodyAsString().contains("Unsupported auth type")) {
    // authenticate with a supported mechanism and retry
  }
}

When it happens

Trigger: Any OpenAPI write endpoint delegating to OpenApiOperatorResolver when the request authenticated as ANONYMOUS or authType was never set in the security context.

Common situations: Endpoint left open to anonymous; security filter failed to populate UserIdentityContextHolder.authType; a new auth mechanism introduced without registering its constant; tests invoking the resolver without a context.

Related errors

• Unsupported auth type: %s
• Unsupported auth type: %s
• Current user not found
• Current user not found
• Current user not found

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/9a56552c1ae47d6e. Report an issue: GitHub.