apolloconfig/apollo · error · BadRequestException

User token operation is not allowed:%s

Error message

User token operation is not allowed:%s

What it means

Thrown by UserTokenService.normalizeOperations() → isOperationAvailable() during token creation when the operation string is recognized (it's in UserTokenOperation.ALL) but the creating user lacks the permission to grant it. Resource-scoped operations (config:read, config:modify, config:release, namespace:create, namespace:delete, cluster:create, app:manage-role) are always available. The privileged operations app:create, user:manage, and system:admin require hasCreateApplicationPermission(), hasManageUsersPermission(), and isSuperAdmin() respectively. BadRequestException → HTTP 400.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/UserTokenService.java:330

    scope.setEnvs(emptyToNull(request.getEnvs()));
    scope.setNamespaces(request.getNamespaces());
    return scope;
  }

  private Set<String> normalizeOperations(Set<String> operations) {
    if (operations == null || operations.isEmpty()) {
      return null;
    }
    Set<String> normalized = new HashSet<>();
    for (String operation : operations) {
      if (StringUtils.isBlank(operation)) {
        continue;
      }
      if (!UserTokenOperation.ALL.contains(operation)) {
        throw new BadRequestException("Invalid user token operation:%s", operation);
      }
      if (!isOperationAvailable(operation)) {
        throw new BadRequestException("User token operation is not allowed:%s", operation);
      }
      normalized.add(operation);
    }
    return normalized.isEmpty() ? null : normalized;
  }

  private boolean isOperationAvailable(String operation) {
    if (UserTokenOperation.RESOURCE_SCOPED.contains(operation)) {
      return true;
    }
    if (UserTokenOperation.APP_CREATE.equals(operation)) {
      return userPermissionValidator.hasCreateApplicationPermission();
    }
    if (UserTokenOperation.USER_MANAGE.equals(operation)) {
      return userPermissionValidator.hasManageUsersPermission();
    }
    if (UserTokenOperation.SYSTEM_ADMIN.equals(operation)) {
      return userPermissionValidator.isSuperAdmin();

View on GitHub (pinned to d95fc18d11)

Solutions

1. Only request operations you have permission for — use findAvailableOperations() to check beforehand.
2. If the user should have access, grant the corresponding portal role/permission (create application, manage users, or super admin).
3. Remove the privileged operation from the request and retry with only resource-scoped operations.

Example fix

// before
List<String> available = userTokenService.findAvailableOperations();
request.setOperations(Set.of("system:admin")); // not in available list
// after
request.setOperations(new HashSet<>(available));

Set<String> available = new HashSet<>(userTokenService.findAvailableOperations());
Set<String> requested = request.getOperations();
if (requested != null && !available.containsAll(requested)) {
    Set<String> disallowed = new HashSet<>(requested);
    disallowed.removeAll(available);
    throw new IllegalStateException("Operations not permitted for this user: " + disallowed);
}
userTokenService.createToken(request, operator);

static boolean isOperationPermitted(UserTokenService svc, String operation) {
    return svc.findAvailableOperations().contains(operation);
}

try {
    userTokenService.createToken(request, operator);
} catch (BadRequestException e) {
    if (e.getMessage().contains("not allowed")) {
        List<String> available = userTokenService.findAvailableOperations();
        return Response.status(400).entity("Available operations: " + available).build();
    }
    throw e;
}

When it happens

Trigger: A non-privileged user calls createToken() requesting operations=['system:admin'] or ['user:manage'] or ['app:create'] without the corresponding portal permission. For example, a regular developer trying to create a token with system:admin scope.

Common situations: A user who recently lost an admin role still tries to create a token with elevated operations. A frontend form shows all operations regardless of the user's current permissions. Misconfigured role assignments in the portal.

Related errors

• userIds should not be null or empty
• Assign role permission is required
• App not found: {appId}
• Access is denied
• Create cluster permission is required

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/55ea8538ca00d7e1. Report an issue: GitHub.