apolloconfig/apollo · error · BadRequestException

Unsupported auth type: %s

Error message

Unsupported auth type: %s

What it means

HTTP 400 (BadRequestException). Thrown by NamespaceBranchController.resolveOperator when UserIdentityContextHolder.getAuthType() is not one of USER, USER_TOKEN, or CONSUMER (e.g. ANONYMOUS, null, or an unknown value). The controller cannot decide how to derive the operator string without a recognized auth type.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceBranchController.java:286

        || UserIdentityConstants.USER_TOKEN.equals(authType)) {
      UserInfo loginUser = userInfoHolder.getUser();
      if (loginUser == null || StringUtils.isBlank(loginUser.getUserId())) {
        throw new BadRequestException("Current user not found");
      }
      return loginUser.getUserId();
    }

    if (UserIdentityConstants.CONSUMER.equals(authType)) {
      String operator = StringUtils.isBlank(queryOperator) ? payloadOperator : queryOperator;
      RequestPrecondition.checkArguments(!StringUtils.isContainEmpty(operator),
          "operator should not be null or empty");
      if (userService.findByUserId(operator) == null) {
        throw BadRequestException.userNotExists(operator);
      }
      return operator;
    }

    throw new BadRequestException("Unsupported auth type: %s", authType);
  }

  private boolean shouldHideConfigToCurrentUser(String appId, String env, String clusterName,
      String namespaceName) {
    return UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())
        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,
            namespaceName);
  }

  private void requireConfigReadForUserToken(String appId, String env, String clusterName,
      String namespaceName) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,
            namespaceName)) {
      throw new AccessDeniedException("Access is denied");
    }
  }
}

View on GitHub (pinned to d95fc18d11)

Solutions

1. Ensure the request authenticates with one of the supported mechanisms (portal SSO -> USER, user-token -> USER_TOKEN, OpenAPI token -> CONSUMER).
2. Fix the security filter so it populates UserIdentityContextHolder.authType for every authenticated request.
3. If anonymous must reach this path, gate it earlier or reject it before the controller; resolveOperator has no anonymous fallback.
4. Check that the auth-type constant matches exactly 'USER'/'USER_TOKEN'/'CONSUMER'.

Example fix

// before: authType = ANONYMOUS (or null) -> 400
String operator = resolveOperator(query, payload);

// after: authenticate as a supported type
// CONSUMER with explicit operator
client.withOpenApiToken(token).createBranch(..., operator="svcacct");

// Ensure a recognized auth type before any write.
String authType = UserIdentityContextHolder.getAuthType();
if (!Set.of("USER","USER_TOKEN","CONSUMER").contains(authType)) {
  // authenticate properly; do not call resolveOperator
}

null

try {
  client.createBranch(appId, env, cluster, ns, operator);
} catch (HttpClientErrorException.BadRequest e) {
  if (e.getResponseBodyAsString().contains("Unsupported auth type")) {
    // switch to a supported auth mechanism (CONSUMER + operator)
  }
}

When it happens

Trigger: Any NamespaceBranch mutating API call where the request was authenticated as ANONYMOUS (or where the auth-type context was never set) and still reached the controller. Indicates a missing authentication filter or a public endpoint that should have been protected.

Common situations: An endpoint misconfigured to permit anonymous access; a security filter that failed to set UserIdentityContextHolder.authType; a new auth scheme introduced without registering its auth-type constant; integration tests hitting the controller bean directly without a security context.

Related errors

• Unsupported auth type: %s
• Unsupported auth type: %s
• Current user not found
• Current user not found
• Current user not found

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/f988250d42d500a6. Report an issue: GitHub.