使用创建的用户注册到nacos时出现403 #3961

zbsBrave · 2020-10-09T14:58:05Z

1，设置nacos.core.auth.enabled=true
2，使用nacos新创建一个用户gataway，密码gataway
3，使用这个账号和密码注册到nacos失败，Caused by: com.alibaba.nacos.api.exception.NacosException: failed to req API:/nacos/v1/ns/instance after all servers([ctos.cn:8848]) tried: ErrCode:403,
4，使用username=nacos时注册到nacos是正常的

bootstrap.yml是这样的：
spring:
cloud:
nacos:
server-addr: ctos.cn:8848
username: gateway
password: gateway
config:
namespace: 6f257580-f5cc-4f5a-aeb3-1194dfe793f4
file-extension: yml

horizonzy · 2020-10-09T17:49:13Z

服务端开启了权限的情况下。注册服务需要保证登陆的用户要写写操作的权限，给你的这个gateway用户分配一下写操作的权限

zbsBrave · 2020-10-10T10:38:30Z

服务端开启了权限的情况下。注册服务需要保证登陆的用户要写写操作的权限，给你的这个网关用户分配一下写操作的权限

horizonzy · 2020-10-10T12:36:38Z

用户和角色挂钩没得

KomachiSion · 2020-10-12T02:50:28Z

角色又读写权限，然后需要把这个用户设定为这个角色。

zbsBrave · 2020-10-12T03:25:21Z

角色又读写权限，然后需要把这个用户设定为这个角色。
这是用户管理：gateway | ************************************************************ | 修改
这是角色管理：ROLE_GATEWAY | gateway
这是权限管理：
ROLE_GATEWAY | public | 读写 (rw) |
ROLE_GATEWAY | gateway (6f257580-f5cc-4f5a-aeb3-1194dfe793f4) | 读写 (rw)

感觉这个应该不是权限配置的问题，因为在最开始能够读取到nacos远程配置的数据，这个‘hi,这是test 11111’就是配置在nacos的。

以下是日志：
hi,这是test 11111
2020-10-12 11:07:34.924 WARN 11132 --- [ 2020-10-12 11:07:34.924 INFO 11132 --- [ 2020-10-12 11:07:34.926 WARN 11132 --- [ 2020-10-12 11:07:34.926 INFO 11132 --- [ 2020-10-12 11:07:36.236 INFO 11132 --- [ 2020-10-12 11:07:37.561 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:37.936 INFO 11132 --- [ 2020-10-12 11:07:39.290 INFO 11132 --- [ 2020-10-12 11:07:40.557 INFO 11132 --- [ 2020-10-12 11:07:40.621 ERROR 11132 --- [ Caused by: com.alibaba.nacos.api.exceptio main] c.n.c.sources.URLConfigurationSource : No URLs will be polled as dynamic configuration sources.
main] c.n.c.sources.URLConfigurationSource : To enable URLs as dynamic configuration sources, define System property archaius.configurationSource.additionalUrls or make config.properties available on classpath.
main] c.n.c.sources.URLConfigurationSource : No URLs will be polled as dynamic configuration sources.
main] c.n.c.sources.URLConfigurationSource : To enable URLs as dynamic configuration sources, define System property archaius.configurationSource.additionalUrls or make config.properties available on classpath.
main] o.s.cloud.commons.util.InetUtils : Cannot determine local hostname
main] o.s.cloud.commons.util.InetUtils : Cannot determine local hostname
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [After]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [Before]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [Between]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [Cookie]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [Header]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [Host]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [Method]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [Path]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [Query]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [ReadBodyPredicateFactory]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [RemoteAddr]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [Weight]
main] o.s.c.g.r.RouteDefinitionRouteLocator : Loaded RoutePredicateFactory [CloudFoundryRouteService]
main] o.s.cloud.commons.util.InetUtils : Cannot determine local hostname
main] o.s.cloud.commons.util.InetUtils : Cannot determine local hostname
main] com.alibaba.nacos.client.naming : [NA] failed to request
n.NacosException: failed to req API:/nacos/v1/ns/instance after all servers([ctos.cn:8848]) tried: ErrCode:403, ErrMsg:

Whitelabel Error Page

This application has no explicit mapping for /error, so you are seeing this as a fallback.

Mon Oct 12 11:07:41 CST 2020

There was an unexpected error (type=Forbidden, status=403).

authorization failed!

at com.alibaba.nacos.client.naming.net.NamingProxy.reqApi(NamingProxy.java:552) ~[nacos-client-1.3.2.jar:na]
at com.alibaba.nacos.client.naming.net.NamingProxy.reqApi(NamingProxy.java:491) ~[nacos-client-1.3.2.jar:na]
at com.alibaba.nacos.client.naming.net.NamingProxy.reqApi(NamingProxy.java:486) ~[nacos-client-1.3.2.jar:na]
at com.alibaba.nacos.client.naming.net.NamingProxy.registerService(NamingProxy.java:239) ~[nacos-client-1.3.2.jar:na]
at com.alibaba.nacos.client.naming.NacosNamingService.registerInstance(NacosNamingService.java:200) ~[nacos-client-1.3.2.jar:na]
at com.alibaba.cloud.nacos.registry.NacosServiceRegistry.register(NacosServiceRegistry.java:70) ~[spring-cloud-starter-alibaba-nacos-discovery-2.2.2.RELEASE.jar:2.2.2.RELEASE]
... 20 common frames omitted

KomachiSion · 2020-10-12T05:38:22Z

看报错是配置中心使用了gateway用户，但是注册中心没有使用gateway用户，403错误都是服务发现模块抛出来的，给服务发现模块也配置一下用户名密码试试

spring:
  cloud:
    nacos:
      naming:
        username: gateway
        password: gateway

zbsBrave · 2020-10-12T12:02:07Z

看报错是配置中心使用了gateway用户，但是注册中心没有使用gateway用户，403错误都是服务发现模块抛出来的，给服务发现模块也配置一下用户名密码试试
spring:
  cloud:
    nacos:
      naming:
        username: gateway
        password: gateway

我这里没有naming配置，只有discovery，配置了discovery的用户名和密码后也报同样错误。
spring:
cloud:
nacos:
server-addr: ctos.cn:8848
username: gateway
password: gateway
config:
namespace: 6f257580-f5cc-4f5a-aeb3-1194dfe793f4
file-extension: yml
discovery:
username: gateway
password: gateway
而且同样配置我用默认的nacos账号是可以正常使用的，应该不是这个配置的原因。
在nacos的配置文件application.properties发现这样一句话，是不是说目前只支持nacos这个账号

The auth system to use, currently only 'nacos' is supported:

nacos.core.auth.system.type=nacos

horizonzy · 2020-10-12T13:56:26Z

看报错是配置中心使用了gateway用户，但是注册中心没有使用gateway用户，403错误都是服务发现模块抛出来的，给服务发现模块也配置一下用户名密码试试
spring:
  cloud:
    nacos:
      naming:
        username: gateway
        password: gateway
我这里没有naming配置，只有discovery，配置了discovery的用户名和密码后也报同样错误。
spring:
cloud:
nacos:
server-addr: ctos.cn:8848
username: gateway
password: gateway
config:
namespace: 6f257580-f5cc-4f5a-aeb3-1194dfe793f4
file-extension: yml
discovery:
username: gateway
password: gateway
而且同样配置我用默认的nacos账号是可以正常使用的，应该不是这个配置的原因。
在nacos的配置文件application.properties发现这样一句话，是不是说目前只支持nacos这个账号

The auth system to use, currently only 'nacos' is supported:

nacos.core.auth.system.type=nacos

这个是认证的类型。

KomachiSion · 2020-10-13T03:03:25Z

@zbsBrave 看一下nacos的access_log，看下是哪个接口报的403，如果你没有使用discovery，应该不启动discovery才对，从报错来看就是启动了discovery，但是discovery没有权限。

KomachiSion · 2020-10-16T06:14:46Z

@zbsBrave 你应用注册的服务是用gateway用户注册到public？那可能会有问题 #3524

zbsBrave · 2020-10-18T03:26:58Z

@zbsBrave 你应用注册的服务是用gateway用户注册到public？那可能会有问题 #3524

谢谢大佬，就是这个问题

KomachiSion added the status/need feedback label Oct 12, 2020

zbsBrave closed this as completed Oct 18, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

使用创建的用户注册到nacos时出现403 #3961

使用创建的用户注册到nacos时出现403 #3961

zbsBrave commented Oct 9, 2020 •

edited

Loading

horizonzy commented Oct 9, 2020

zbsBrave commented Oct 10, 2020

horizonzy commented Oct 10, 2020

KomachiSion commented Oct 12, 2020

zbsBrave commented Oct 12, 2020 •

edited

Loading

KomachiSion commented Oct 12, 2020

zbsBrave commented Oct 12, 2020

horizonzy commented Oct 12, 2020

The auth system to use, currently only 'nacos' is supported:

KomachiSion commented Oct 13, 2020

KomachiSion commented Oct 16, 2020

zbsBrave commented Oct 18, 2020

使用创建的用户注册到nacos时出现403 #3961

使用创建的用户注册到nacos时出现403 #3961

Comments

zbsBrave commented Oct 9, 2020 • edited Loading

horizonzy commented Oct 9, 2020

zbsBrave commented Oct 10, 2020

horizonzy commented Oct 10, 2020

KomachiSion commented Oct 12, 2020

zbsBrave commented Oct 12, 2020 • edited Loading

Whitelabel Error Page

KomachiSion commented Oct 12, 2020

zbsBrave commented Oct 12, 2020

The auth system to use, currently only 'nacos' is supported:

horizonzy commented Oct 12, 2020

The auth system to use, currently only 'nacos' is supported:

KomachiSion commented Oct 13, 2020

KomachiSion commented Oct 16, 2020

zbsBrave commented Oct 18, 2020

zbsBrave commented Oct 9, 2020 •

edited

Loading

zbsBrave commented Oct 12, 2020 •

edited

Loading