# ACL plugin not working in db-less mode

**URL:** <https://discuss.konghq.com/t/acl-plugin-not-working-in-db-less-mode/6033>\
**Category:** Questions\
**Created:** [April 15, 2020, 7:15am UTC](https://discuss.konghq.com/t/acl-plugin-not-working-in-db-less-mode/6033 "2020-04-15T07:15:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![danuka92](https://avatars.discourse-cdn.com/v4/letter/d/a8b319/32.png) [@danuka92](https://discuss.konghq.com/u/danuka92)\
**Post date:** [April 15, 2020, 7:15am UTC](https://discuss.konghq.com/t/acl-plugin-not-working-in-db-less-mode/6033/1 "2020-04-15T07:15:16Z")

</div>

Hi All,

I created a key auth plugin with two consumers and two auth keys. I can access the API with these two keys without any issue. Then I created two ACL plugins as belows.

```
echo "
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: acl-wl-test-sp
config:
  whitelist:
  - test-sp
  hide_groups_header: true
plugin: acl
" | oc apply -f -

echo "
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: acl-bl-test-sp
config:
  blacklist:
  - test-sp
  hide_groups_header: true
plugin: acl
" | oc apply -f -

```

When I add this acl-wl-test-sp plugin to my API service, I cannot access API with any of the keys from test-sp or test-sp2.

```
HTTP code : 403Forbidden
{
    "message": "You cannot consume this service"
}

```

When I remove the above and add acl-bl-test-sp plugin to my API service, I can access the API with any of the keys of test-sp and test-sp2. This is the not the expected behavior of this plugin.

```
oc patch service proxy-from-k8s-to-ext -p '{"metadata":{"annotations":{"konghq.com/plugins":"acl-wl-test-sp"}}}'
oc patch service proxy-from-k8s-to-ext -p '{"metadata":{"annotations":{"konghq.com/plugins":"acl-bl-test-sp"}}}'

```

Appreciate your input.

Thanks!

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [April 15, 2020, 4:14pm UTC](https://discuss.konghq.com/t/acl-plugin-not-working-in-db-less-mode/6033/2 "2020-04-15T16:14:03Z")

</div>

Did you add the consumers to the ACL group?

---

<div class="post-metadata">

**Author:** ![danuka92](https://avatars.discourse-cdn.com/v4/letter/d/a8b319/32.png) [@danuka92](https://discuss.konghq.com/u/danuka92)\
**Post date:** [April 15, 2020, 4:16pm UTC](https://discuss.konghq.com/t/acl-plugin-not-working-in-db-less-mode/6033/3 "2020-04-15T16:16:18Z")

</div>

> [@danuka92](#):
>
> test-sp

@hbagdi,  
‘test-sp’ added to the ACL plugin is a consumer created for an auth keys

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [April 15, 2020, 4:38pm UTC](https://discuss.konghq.com/t/acl-plugin-not-working-in-db-less-mode/6033/4 "2020-04-15T16:38:19Z")

</div>

Have a look at this guide to understand how ACL works:

> <https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/guides/configure-acl-plugin.md>