鉴权无法通过配置文件开启 #11891

ggg17226 · 2024-03-28T15:03:00Z

nacos无法开启鉴权，包括集群和单机模式。
web ui显示：

当前集群没有开启鉴权，请参考文档开启鉴权~

使用curl直接请求接口可以直接请求成功。

nacos版本：2.3.1，使用GitHub release页面下载的2.3.1版本的tar.gz包中的jar包。

# sha256sum
b46fd3a41e947a8d42010f50fdfdac595dc7f09ce2f20b14f123ec0926be843c  target/nacos-server.jar

JAVA版本：openjdk 17.0.10

JAVA LOCATION: /usr/bin/java
============
openjdk version "17.0.10" 2024-01-16
OpenJDK Runtime Environment (build 17.0.10+7-Ubuntu-122.04.1)
OpenJDK 64-Bit Server VM (build 17.0.10+7-Ubuntu-122.04.1, mixed mode, sharing)

启动命令行：

/usr/bin/java  -XX:+UseZGC -Xmx512m -Xms512m -XX:MaxMetaspaceSize=128m    \
 -XX:-OmitStackTraceInFastThrow -XX:+HeapDumpOnOutOfMemoryError \
-XX:HeapDumpPath=/app/jvm_heap_dump/heap_dump_%t.hprof  \
-Xlog:gc*:file=/app/jvm_logs/nacos_gc.log:time,tags:filecount=10,filesize=100m    \
-Dloader.path=/app/plugins,/app/plugins/health,/app/plugins/cmdb,/app/plugins/selector  \
-Dnacos.home=/app  -jar /app/target/nacos-server.jar  \
--spring.config.additional-location=/app/conf/  --logging.config=/app/conf/nacos-logback.xml  \
--server.max-http-header-size=524288  --server.tomcat.accesslog.enabled=false  \
--spring.profiles.active=cluster --nacos.inetutils.ip-address=x.x.x.x

配置文件application-cluster.properties

server.servlet.contextPath=/nacos
server.error.include-message=ALWAYS
server.port=8848
spring.sql.init.platform=mysql
db.num=1
db.url.0=jdbc:mysql://x.x.x.x:3306/nacos?characterEncoding=utf8&connectTimeout=1000&socketTimeout=3000&autoReconnect=true&useUnicode=true&useSSL=false&serverTimezone=UTC&allowPublicKeyRetrieval=true
db.user.0=nacos
db.password.0=******
db.pool.config.connectionTimeout=30000
db.pool.config.validationTimeout=10000
db.pool.config.maximumPoolSize=20
db.pool.config.minimumIdle=2
nacos.config.push.maxRetryTime=50
nacos.naming.data.warmup=true
nacos.naming.expireInstance=true
nacos.naming.clean.empty-service.interval=30000
nacos.naming.clean.empty-service.expired-time=30000
nacos.naming.clean.expired-metadata.interval=5000
nacos.naming.clean.expired-metadata.expired-time=30000
nacos.naming.push.pushTaskDelay=500
nacos.naming.push.pushTaskTimeout=5000
nacos.naming.push.pushTaskRetryDelay=1000
nacos.naming.client.expired.time=180000
server.tomcat.mbeanregistry.enabled=true
management.endpoints.web.exposure.include=prometheus,health
management.metrics.export.elastic.enabled=false
management.metrics.export.influx.enabled=false
server.tomcat.accesslog.enabled=false
server.tomcat.accesslog.rotate=true
server.tomcat.accesslog.file-date-format=.yyyy-MM-dd-HH
server.tomcat.accesslog.pattern=%h %l %u %t "%r" %s %b %D %{User-Agent}i %{Request-Source}i
server.tomcat.basedir=file:.
nacos.security.ignore.urls=/,/error,/**/*.css,/**/*.js,/**/*.html,/**/*.map,/**/*.svg,/**/*.png,/**/*.ico,/console-ui/public/**,/v1/auth/**,/v1/console/health/**,/actuator/**,/v1/console/server/**
nacos.core.auth.system.type=nacos
nacos.core.auth.enabled=true
nacos.core.auth.caching.enabled=true
nacos.core.auth.enable.userAgentAuthWhite=false
nacos.core.auth.server.identity.key=**********
nacos.core.auth.server.identity.value=*********
nacos.core.auth.plugin.nacos.token.cache.enable=false
nacos.core.auth.plugin.nacos.token.expire.seconds=18000
nacos.core.auth.plugin.nacos.token.secret.key=**************
nacos.istio.mcp.server.enabled=false
nacos.console.ui.enabled=true
nacos.plugin.control.manager.type=nacos
nacos.core.member.lookup.type=file

nacos.log中可见

2024-03-28 15:00:54,216 INFO Will secure any request with [org.springframework.security.web.session.DisableEncodeUrlFilter@5d94a2dc, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@cedee22, org.springframework.security.web.context.SecurityContextPersistenceFilter@73a0f2b, org.springframework.security.web.header.HeaderWriterFilter@f9cab00, org.springframework.security.web.csrf.CsrfFilter@7dcb42a9, org.springframework.security.web.authentication.logout.LogoutFilter@5a917723, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@6a1d526c, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@1f2f0109, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@59b32539, org.springframework.security.web.session.SessionManagementFilter@3f96f020, org.springframework.security.web.access.ExceptionTranslationFilter@1b410308]
2024-03-28 15:00:55,138 WARN You are asking Spring Security to ignore Ant [pattern='/**']. This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead.
2024-03-28 15:00:55,139 WARN You are asking Spring Security to ignore Mvc [pattern='/prometheus']. This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead.
2024-03-28 15:00:55,139 WARN You are asking Spring Security to ignore Mvc [pattern='/prometheus/namespaceId/{namespaceId}']. This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead.
2024-03-28 15:00:55,140 WARN You are asking Spring Security to ignore Mvc [pattern='/prometheus/namespaceId/{namespaceId}/service/{service}']. This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead.
2024-03-28 15:01:20,058 INFO [AuthPluginManager] Load AuthPluginService(class com.alibaba.nacos.plugin.auth.impl.NacosAuthPluginService) AuthServiceName(nacos) successfully.
2024-03-28 15:01:20,058 INFO [AuthPluginManager] Load AuthPluginService(class com.alibaba.nacos.plugin.auth.impl.LdapAuthPluginService) AuthServiceName(ldap) successfully.

The text was updated successfully, but these errors were encountered:

ggg17226 · 2024-03-28T16:00:41Z

使用jdb进入查看如上图

ggg17226 · 2024-03-28T16:12:30Z

使用命令行参数--nacos.core.auth.enabled --nacos.core.auth.plugin.nacos.token.secret.key --nacos.core.auth.server.identity.key --nacos.core.auth.server.identity.value 可以成功开启鉴权

KomachiSion · 2024-04-01T04:10:28Z

我测试了下2.3.1 是可以通过配置文件开启鉴权的，你的如果无法开启，可能是因为spring.profiles.active的配置文件优先级过低，被其他的默认配置覆盖了，建议直接修改application.properties.

ggg17226 · 2024-04-01T20:26:14Z

使用单机模式以及内嵌数据库复现

agh0st/nacos-test:2.3.1-20240402-0417T08 此镜像可以直接从docker hub pull

linux内核：

# docker run -p 8848:8848 -it --rm agh0st/nacos-test:2.3.1-20240402-0417T08 bash -c "uname -a"
Linux 9ce466103734 6.2.0-37-generic #38~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Nov  2 18:01:13 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

jdk版本：

# docker run -p 8848:8848 -it --rm agh0st/nacos-test:2.3.1-20240402-0417T08 bash -c "java -version"
openjdk version "17.0.10" 2024-01-16
OpenJDK Runtime Environment (build 17.0.10+7-Ubuntu-122.04.1)
OpenJDK 64-Bit Server VM (build 17.0.10+7-Ubuntu-122.04.1, mixed mode, sharing)

docker run -p 8848:8848 -it --rm agh0st/nacos-test:2.3.1-20240402-0417T08

FROM agh0st/jdk:latest
ADD ./nacos-server-2.3.1.tar.gz /nacos
RUN mv /nacos/nacos /app && \
    mkdir -p /app/jvm_heap_dump /app/jvm_logs /app/plugins/health \
    /app/plugins/cmdb /app/plugins/selector
COPY ./run.sh /app/
COPY ./application.properties /app/conf/application.properties
WORKDIR /app
CMD /app/run.sh

Raxukl · 2024-04-02T09:20:35Z

我也是这个问题，下载下来包，然后集群配置文件都开启鉴权，但是nacos/v1/console/server/announcement这个url同样显示没有开启鉴权

ggg17226 · 2024-04-02T10:25:56Z

我也是这个问题，下载下来包，然后集群配置文件都开启鉴权，但是nacos/v1/console/server/announcement这个url同样显示没有开启鉴权

#11891 (comment)
我这使用命令行参数可以开启，其他功能正常，你试试看

KomachiSion · 2024-04-03T08:54:39Z

我使用nacos官方镜像+ 环境变量测试单机，内嵌数据库模式，可以开启鉴权

同样使用二进制包+配置文件修改测试单机，内嵌数据库模式，可以开启鉴权。

如果是自己打包的镜像，可能需要自行排查一下了。

Raxukl · 2024-04-03T09:21:48Z

官方linux二进制包，单机和集群部署，内嵌数据库模式，开启鉴权访问/nacos/v1/console/server/announcement，会显示当前集群未开启鉴权

ggg17226 · 2024-04-03T10:08:21Z

我使用nacos官方镜像+ 环境变量测试单机，内嵌数据库模式，可以开启鉴权

同样使用二进制包+配置文件修改测试单机，内嵌数据库模式，可以开启鉴权。

如果是自己打包的镜像，可能需要自行排查一下了。

官方镜像表现一致，命令行参数可用，配置文件配置无效

docker run -it --rm --entrypoint bash nacos/nacos-server:v2.3.1

编辑配置文件后手动调用

export MODE=standalone
./bin/docker-startup.sh

KomachiSion · 2024-04-08T02:19:29Z

官方linux二进制包，单机和集群部署，内嵌数据库模式，开启鉴权访问/nacos/v1/console/server/announcement，会显示当前集群未开启鉴权

这个我自己部署了一下，没有问题，应该是没开启鉴权，或者浏览器缓存未清理。

KomachiSion · 2024-04-08T02:20:48Z

我使用nacos官方镜像+ 环境变量测试单机，内嵌数据库模式，可以开启鉴权
同样使用二进制包+配置文件修改测试单机，内嵌数据库模式，可以开启鉴权。
如果是自己打包的镜像，可能需要自行排查一下了。

官方镜像表现一致，命令行参数可用，配置文件配置无效

docker run -it --rm --entrypoint bash nacos/nacos-server:v2.3.1

编辑配置文件后手动调用
export MODE=standalone
./bin/docker-startup.sh

Nacos的官方镜像是通过环境变量开启鉴权的，预设的配置文件中应该是以变量的形式存放，默认是不开启

ggg17226 · 2024-04-08T09:59:06Z

我使用nacos官方镜像+ 环境变量测试单机，内嵌数据库模式，可以开启鉴权
同样使用二进制包+配置文件修改测试单机，内嵌数据库模式，可以开启鉴权。
如果是自己打包的镜像，可能需要自行排查一下了。

官方镜像表现一致，命令行参数可用，配置文件配置无效

docker run -it --rm --entrypoint bash nacos/nacos-server:v2.3.1

编辑配置文件后手动调用
export MODE=standalone
./bin/docker-startup.sh
Nacos的官方镜像是通过环境变量开启鉴权的，预设的配置文件中应该是以变量的形式存放，默认是不开启

使用

docker run -it --rm --entrypoint bash nacos/nacos-server:v2.3.1

启动的容器，然后手动编辑了配置文件并手动启动服务

KomachiSion · 2024-04-15T07:12:31Z

默认镜像的开关在docker-startup.sh里通过环境变量读取之后再通过-D参数传递，根据spring boot的规范，单机应用的优先级为：spring prop -> jvm prop -> ENV prop -> file(s) prop.

所以你在配置文件里配置不生效很正常：你需要做的是：

改./bin/docker-startup.sh，去除以下部分：

if [[ ! -z "${NACOS_AUTH_ENABLE}" ]]; then
  JAVA_OPT="${JAVA_OPT} -Dnacos.core.auth.enabled=${NACOS_AUTH_ENABLE}"

再改conf/application.properties

KomachiSion · 2024-04-15T07:13:20Z

nacos默认镜像提供了开关，不需要自行修改内部文件。

如果是自定义镜像，那由镜像构建时自行定义。

Raxukl · 2024-04-20T00:01:17Z

我看源码中nacos/v1/console/server/announcemen接口是固定读取conf目录下announcement_zh-CN.conf这个文件内容的

KomachiSion · 2024-04-22T02:23:09Z

我看源码中nacos/v1/console/server/announcemen接口是固定读取conf目录下announcement_zh-CN.conf这个文件内容的

开启鉴权后，控制台前端不会调用此接口。

Raxukl · 2024-04-22T06:51:41Z

要是调用后端还是会输出文件内容的吧

KomachiSion · 2024-04-25T03:10:52Z

要是调用后端还是会输出文件内容的吧

那肯定的，因为接口的定义本身就是读取announcemen并返回。

KomachiSion · 2024-05-06T03:29:08Z

No more response from author, It seems usage problem.

ggg17226 changed the title ~~鉴权无法开启~~ 鉴权无法通过配置文件开启 Mar 28, 2024

KomachiSion added the status/need feedback label Apr 1, 2024

alibaba deleted a comment from Banihanimohammad22 Apr 3, 2024

KomachiSion closed this as not planned Won't fix, can't repro, duplicate, stale May 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

鉴权无法通过配置文件开启 #11891

鉴权无法通过配置文件开启 #11891

ggg17226 commented Mar 28, 2024 •

edited

Loading

ggg17226 commented Mar 28, 2024

ggg17226 commented Mar 28, 2024

KomachiSion commented Apr 1, 2024

ggg17226 commented Apr 1, 2024 •

edited

Loading

Raxukl commented Apr 2, 2024

ggg17226 commented Apr 2, 2024

KomachiSion commented Apr 3, 2024

Raxukl commented Apr 3, 2024 •

edited

Loading

ggg17226 commented Apr 3, 2024 •

edited

Loading

KomachiSion commented Apr 8, 2024

KomachiSion commented Apr 8, 2024

ggg17226 commented Apr 8, 2024

KomachiSion commented Apr 15, 2024

KomachiSion commented Apr 15, 2024

Raxukl commented Apr 20, 2024

KomachiSion commented Apr 22, 2024

Raxukl commented Apr 22, 2024

KomachiSion commented Apr 25, 2024

KomachiSion commented May 6, 2024

鉴权无法通过配置文件开启 #11891

鉴权无法通过配置文件开启 #11891

Comments

ggg17226 commented Mar 28, 2024 • edited Loading

ggg17226 commented Mar 28, 2024

ggg17226 commented Mar 28, 2024

KomachiSion commented Apr 1, 2024

ggg17226 commented Apr 1, 2024 • edited Loading

Raxukl commented Apr 2, 2024

ggg17226 commented Apr 2, 2024

KomachiSion commented Apr 3, 2024

Raxukl commented Apr 3, 2024 • edited Loading

ggg17226 commented Apr 3, 2024 • edited Loading

KomachiSion commented Apr 8, 2024

KomachiSion commented Apr 8, 2024

ggg17226 commented Apr 8, 2024

KomachiSion commented Apr 15, 2024

KomachiSion commented Apr 15, 2024

Raxukl commented Apr 20, 2024

KomachiSion commented Apr 22, 2024

Raxukl commented Apr 22, 2024

KomachiSion commented Apr 25, 2024

KomachiSion commented May 6, 2024

ggg17226 commented Mar 28, 2024 •

edited

Loading

ggg17226 commented Apr 1, 2024 •

edited

Loading

Raxukl commented Apr 3, 2024 •

edited

Loading

ggg17226 commented Apr 3, 2024 •

edited

Loading