# Cannot figure out ACL plugin

**URL:** <https://discuss.konghq.com/t/cannot-figure-out-acl-plugin/12391>\
**Category:** Questions\
**Created:** [February 14, 2024, 7:51am UTC](https://discuss.konghq.com/t/cannot-figure-out-acl-plugin/12391 "2024-02-14T07:51:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dwarce](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/dwarce/32/4356_2.png) [@dwarce](https://discuss.konghq.com/u/dwarce)\
**Post date:** [February 14, 2024, 7:51am UTC](https://discuss.konghq.com/t/cannot-figure-out-acl-plugin/12391/1 "2024-02-14T07:51:03Z")

</div>

Hello,

I am using the OSS version of kong 3.5, and I’m trying to enable ACL plugin on one of my routes. (I’m using Kong manager)  
Currently I have a route with name “example\_route” and a consumer with username “example\_consumer”.  
On the route, I have enabled plugin key authentication. Inside consumer’s credentials, I have added a new key-auth credential.  
Up to this step, everything worked as expected.  
Then I enabled the ACL plugin on the “example\_route” and added “example\_consumer” in the allowed section.  
However, my request now fails with error message “You cannot consume this service”.

Is it possible, that it’s because my consumer is not in a group? The problem is, I cannot create consumer groups in OSS version of Kong.

Regards!

---

<div class="post-metadata">

**Author:** ![dwarce](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/dwarce/32/4356_2.png) [@dwarce](https://discuss.konghq.com/u/dwarce)\
**Post date:** [February 14, 2024, 9:35am UTC](https://discuss.konghq.com/t/cannot-figure-out-acl-plugin/12391/2 "2024-02-14T09:35:05Z")

</div>

Hi, I’ve figured it out.  
After I enable the ACL plugin, I must define the ACL group within consumer credentials.

Now it works as expected.

---

<div class="post-metadata">

**Author:** ![christoph](https://avatars.discourse-cdn.com/v4/letter/c/eb8c5e/32.png) [@christoph](https://discuss.konghq.com/u/christoph)\
**Post date:** [February 24, 2024, 10:53pm UTC](https://discuss.konghq.com/t/cannot-figure-out-acl-plugin/12391/3 "2024-02-24T22:53:16Z")

</div>

Hi @dwarce can you tell me what you mean by defining the ACL group within consumer credentials? I think I have the same or similar problem. I use Kong db-less in Kubernetes and everything works for me including authentication, but the ACL won’t work because I cannot assign consumers to groups.  
King regards 🙂