NACOS2.3.0开启鉴权登录

 环境

表现：java使用java version "17.0.14" 2025-01-21 LTS，配置开启鉴权登录不生效，不用输入密码用户还是可以登录，配置文件如下。

重启也是不管用，jdk8配置重启正常

#

# Copyright 1999-2021 Alibaba Group Holding Ltd.

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#      http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

#

 

#*************** Spring Boot Related Configurations ***************#

### Default web context path:

server.servlet.contextPath=/nacos

### Include message field

server.error.include-message=ALWAYS

### Default web server port:

server.port=8848

 

#*************** Network Related Configurations ***************#

### If prefer hostname over ip for Nacos server addresses in cluster.conf:

# nacos.inetutils.prefer-hostname-over-ip=false

 

### Specify local server's IP:

# nacos.inetutils.ip-address=

 

 

#*************** Config Module Related Configurations ***************#

### If use MySQL as datasource:

### Deprecated configuration property, it is recommended to use `spring.sql.init.platform` replaced.

spring.datasource.platform=mysql

spring.sql.init.platform=mysql

 

### Count of DB:

db.num=1

 

### Connect URL of DB:

db.url.0=jdbc:mysql://127.0.0.1:3306/nacos230?characterEncoding=utf8&connectTimeout=1000&socketTimeout=3000&autoReconnect=true&useUnicode=true&useSSL=false&serverTimezone=UTC

db.user.0=root

db.password.0=123456

 

### Connection pool configuration: hikariCP

db.pool.config.connectionTimeout=30000

db.pool.config.validationTimeout=10000

db.pool.config.maximumPoolSize=20

db.pool.config.minimumIdle=2

 

### the maximum retry times for push

nacos.config.push.maxRetryTime=50

 

#*************** Naming Module Related Configurations ***************#

 

### If enable data warmup. If set to false, the server would accept request without local data preparation:

# nacos.naming.data.warmup=true

 

### If enable the instance auto expiration, kind like of health check of instance:

# nacos.naming.expireInstance=true

 

### Add in 2.0.0

### The interval to clean empty service, unit: milliseconds.

# nacos.naming.clean.empty-service.interval=60000

 

### The expired time to clean empty service, unit: milliseconds.

# nacos.naming.clean.empty-service.expired-time=60000

 

### The interval to clean expired metadata, unit: milliseconds.

# nacos.naming.clean.expired-metadata.interval=5000

 

### The expired time to clean metadata, unit: milliseconds.

# nacos.naming.clean.expired-metadata.expired-time=60000

 

### The delay time before push task to execute from service changed, unit: milliseconds.

# nacos.naming.push.pushTaskDelay=500

 

### The timeout for push task execute, unit: milliseconds.

# nacos.naming.push.pushTaskTimeout=5000

 

### The delay time for retrying failed push task, unit: milliseconds.

# nacos.naming.push.pushTaskRetryDelay=1000

 

### Since 2.0.3

### The expired time for inactive client, unit: milliseconds.

# nacos.naming.client.expired.time=180000

 

#*************** CMDB Module Related Configurations ***************#

### The interval to dump external CMDB in seconds:

# nacos.cmdb.dumpTaskInterval=3600

 

### The interval of polling data change event in seconds:

# nacos.cmdb.eventTaskInterval=10

 

### The interval of loading labels in seconds:

# nacos.cmdb.labelTaskInterval=300

 

### If turn on data loading task:

# nacos.cmdb.loadDataAtStart=false

 

#***********Metrics for tomcat **************************#

server.tomcat.mbeanregistry.enabled=true

 

#***********Expose prometheus and health **************************#

#management.endpoints.web.exposure.include=prometheus,health

 

### Metrics for elastic search

management.metrics.export.elastic.enabled=false

#management.metrics.export.elastic.host=http://localhost:9200

 

### Metrics for influx

management.metrics.export.influx.enabled=false

#management.metrics.export.influx.db=springboot

#management.metrics.export.influx.uri=http://localhost:8086

#management.metrics.export.influx.auto-create-db=true

#management.metrics.export.influx.consistency=one

#management.metrics.export.influx.compressed=true

 

#*************** Access Log Related Configurations ***************#

### If turn on the access log:

server.tomcat.accesslog.enabled=true

 

### file name pattern, one file per hour

server.tomcat.accesslog.rotate=true

server.tomcat.accesslog.file-date-format=.yyyy-MM-dd-HH

### The access log pattern:

server.tomcat.accesslog.pattern=%h %l %u %t "%r" %s %b %D %{User-Agent}i %{Request-Source}i

 

### The directory of access log:

server.tomcat.basedir=file:.

 

#*************** Access Control Related Configurations ***************#

### If enable spring security, this option is deprecated in 1.2.0:

spring.security.enabled=true

 

### The ignore urls of auth

nacos.security.ignore.urls=/,/error,/**/*.css,/**/*.js,/**/*.html,/**/*.map,/**/*.svg,/**/*.png,/**/*.ico,/console-ui/public/**,/v1/auth/**,/v1/console/health/**,/actuator/**,/v1/console/server/**

 

### The auth system to use, currently only 'nacos' and 'ldap' is supported:

nacos.core.auth.system.type=nacos

 

### If turn on auth system:

nacos.core.auth.enabled=true

 

### Turn on/off caching of auth information. By turning on this switch, the update of auth information would have a 15 seconds delay.

nacos.core.auth.caching.enabled=true

 

### Since 1.4.1, Turn on/off white auth for user-agent: nacos-server, only for upgrade from old version.

nacos.core.auth.enable.userAgentAuthWhite=false

 

### Since 1.4.1, worked when nacos.core.auth.enabled=true and nacos.core.auth.enable.userAgentAuthWhite=false.

### The two properties is the white list for auth and used by identity the request from other server.

nacos.core.auth.server.identity.key=serverIdentity

nacos.core.auth.server.identity.value=security

 

### worked when nacos.core.auth.system.type=nacos

### The token expiration in seconds:

nacos.core.auth.plugin.nacos.token.cache.enable=false

nacos.core.auth.plugin.nacos.token.expire.seconds=18000

### The default token (Base64 String):

nacos.core.auth.plugin.nacos.token.secret.key=VGhpc0lzTXlTdXBlclNlY3JldEtleTExMTExMTExMTExMTExMTExMTExMTExMQ==

 

### worked when nacos.core.auth.system.type=ldap，{0} is Placeholder,replace login username

#nacos.core.auth.ldap.url=ldap://localhost:389

#nacos.core.auth.ldap.basedc=dc=example,dc=org

#nacos.core.auth.ldap.userDn=cn=admin,${nacos.core.auth.ldap.basedc}

#nacos.core.auth.ldap.password=admin

#nacos.core.auth.ldap.userdn=cn={0},dc=example,dc=org

#nacos.core.auth.ldap.filter.prefix=uid

#nacos.core.auth.ldap.case.sensitive=true

#nacos.core.auth.ldap.ignore.partial.result.exception=false

 

#*************** Control Plugin Related Configurations ***************#

# plugin type

#nacos.plugin.control.manager.type=nacos

 

# local control rule storage dir, default ${nacos.home}/data/connection and ${nacos.home}/data/tps

#nacos.plugin.control.rule.local.basedir=${nacos.home}

 

# external control rule storage type, if exist

#nacos.plugin.control.rule.external.storage=

 

#*************** Config Change Plugin Related Configurations ***************#

# webhook

#nacos.core.config.plugin.webhook.enabled=false

# It is recommended to use EB https://help.aliyun.com/document_detail/413974.html

#nacos.core.config.plugin.webhook.url=http://localhost:8080/webhook/send?token=***

# The content push max capacity ,byte

#nacos.core.config.plugin.webhook.contentMaxCapacity=102400

 

# whitelist

#nacos.core.config.plugin.whitelist.enabled=false

# The import file suffixs

#nacos.core.config.plugin.whitelist.suffixs=xml,text,properties,yaml,html

# fileformatcheck,which validate the import file of type and content

#nacos.core.config.plugin.fileformatcheck.enabled=false

 

#*************** Istio Related Configurations ***************#

### If turn on the MCP server:

nacos.istio.mcp.server.enabled=false

 

#*************** Core Related Configurations ***************#

 

### set the WorkerID manually

# nacos.core.snowflake.worker-id=

 

### Member-MetaData

# nacos.core.member.meta.site=

# nacos.core.member.meta.adweight=

# nacos.core.member.meta.weight=

 

### MemberLookup

### Addressing pattern category, If set, the priority is highest

# nacos.core.member.lookup.type=[file,address-server]

## Set the cluster list with a configuration file or command-line argument

# nacos.member.list=192.168.16.101:8847?raft_port=8807,192.168.16.101?raft_port=8808,192.168.16.101:8849?raft_port=8809

## for AddressServerMemberLookup

# Maximum number of retries to query the address server upon initialization

# nacos.core.address-server.retry=5

## Server domain name address of [address-server] mode

# address.server.domain=jmenv.tbsite.net

## Server port of [address-server] mode

# address.server.port=8080

## Request address of [address-server] mode

# address.server.url=/nacos/serverlist

 

#*************** JRaft Related Configurations ***************#

 

### Sets the Raft cluster election timeout, default value is 5 second

# nacos.core.protocol.raft.data.election_timeout_ms=5000

### Sets the amount of time the Raft snapshot will execute periodically, default is 30 minute

# nacos.core.protocol.raft.data.snapshot_interval_secs=30

### raft internal worker threads

# nacos.core.protocol.raft.data.core_thread_num=8

### Number of threads required for raft business request processing

# nacos.core.protocol.raft.data.cli_service_thread_num=4

### raft linear read strategy. Safe linear reads are used by default, that is, the Leader tenure is confirmed by heartbeat

# nacos.core.protocol.raft.data.read_index_type=ReadOnlySafe

### rpc request timeout, default 5 seconds

# nacos.core.protocol.raft.data.rpc_request_timeout_ms=5000

 

#*************** Distro Related Configurations ***************#

 

### Distro data sync delay time, when sync task delayed, task will be merged for same data key. Default 1 second.

# nacos.core.protocol.distro.data.sync.delayMs=1000

 

### Distro data sync timeout for one sync data, default 3 seconds.

# nacos.core.protocol.distro.data.sync.timeoutMs=3000

 

### Distro data sync retry delay time when sync data failed or timeout, same behavior with delayMs, default 3 seconds.

# nacos.core.protocol.distro.data.sync.retryDelayMs=3000

 

### Distro data verify interval time, verify synced data whether expired for a interval. Default 5 seconds.

# nacos.core.protocol.distro.data.verify.intervalMs=5000

 

### Distro data verify timeout for one verify, default 3 seconds.

# nacos.core.protocol.distro.data.verify.timeoutMs=3000

 

### Distro data load retry delay when load snapshot data failed, default 30 seconds.

# nacos.core.protocol.distro.data.load.retryDelayMs=30000

 

### enable to support prometheus service discovery

#nacos.prometheus.metrics.enabled=true

 

### Since 2.3

#*************** Grpc Configurations ***************#

 

## sdk grpc(between nacos server and client) configuration

## Sets the maximum message size allowed to be received on the server.

#nacos.remote.server.grpc.sdk.max-inbound-message-size=10485760

 

## Sets the time(milliseconds) without read activity before sending a keepalive ping. The typical default is two hours.

#nacos.remote.server.grpc.sdk.keep-alive-time=7200000

 

## Sets a time(milliseconds) waiting for read activity after sending a keepalive ping. Defaults to 20 seconds.

#nacos.remote.server.grpc.sdk.keep-alive-timeout=20000

 

 

## Sets a time(milliseconds) that specify the most aggressive keep-alive time clients are permitted to configure. The typical default is 5 minutes

#nacos.remote.server.grpc.sdk.permit-keep-alive-time=300000

 

## cluster grpc(inside the nacos server) configuration

#nacos.remote.server.grpc.cluster.max-inbound-message-size=10485760

 

## Sets the time(milliseconds) without read activity before sending a keepalive ping. The typical default is two hours.

#nacos.remote.server.grpc.cluster.keep-alive-time=7200000

 

## Sets a time(milliseconds) waiting for read activity after sending a keepalive ping. Defaults to 20 seconds.

#nacos.remote.server.grpc.cluster.keep-alive-timeout=20000

 

## Sets a time(milliseconds) that specify the most aggressive keep-alive time clients are permitted to configure. The typical default is 5 minutes

#nacos.remote.server.grpc.cluster.permit-keep-alive-time=300000

 

## open nacos default console ui

nacos.console.ui.enabled=true