AlistGo/alist · error

password not enabled

Error message

password not enabled

What it means

CloudreveV4 login reached the prepare step (GET /session/prepare?email=...) and the server reported that password login is not enabled for this account/site. The driver only implements password login, so it aborts.

Source

Thrown at drivers/cloudreve_v4/util.go:107

	return nil
}

func (d *CloudreveV4) login() error {
	var siteConfig SiteLoginConfigResp
	err := d.request(http.MethodGet, "/site/config/login", nil, &siteConfig)
	if err != nil {
		return err
	}
	if !siteConfig.Authn {
		return errors.New("authn not support")
	}
	var prepareLogin PrepareLoginResp
	err = d.request(http.MethodGet, "/session/prepare?email="+d.Addition.Username, nil, &prepareLogin)
	if err != nil {
		return err
	}
	if !prepareLogin.PasswordEnabled {
		return errors.New("password not enabled")
	}
	if prepareLogin.WebauthnEnabled {
		return errors.New("webauthn not support")
	}
	for range 5 {
		err = d.doLogin(siteConfig.LoginCaptcha)
		if err == nil {
			break
		}
		if err.Error() != "CAPTCHA not match." {
			break
		}
	}
	return err
}

func (d *CloudreveV4) doLogin(needCaptcha bool) error {
	var err error

View on GitHub (pinned to 843d9dc814)

Solutions

  1. Enable password login for the account in Cloudrebve V4 (or ask the admin to).
  2. Use an account that has a password set, and put that exact email in the driver Username field.
  3. Confirm via GET /session/prepare?email=... that password_enabled is true before configuring.
  4. If policy forbids passwords, this driver cannot log in; use a different auth path.

Example fix

curl -sS 'https://v4.example.com/api/v4/session/prepare?email=user@example.com'
# {"code":0,"data":{"password_enabled":false,...}} -> enable password auth for the account
Defensive patterns

Strategy: validation

Validate before calling

var prep PrepareLoginResp
if err := d.request(http.MethodGet, "/session/prepare?email="+d.Addition.Username, nil, &prep); err != nil { return err }
if !prep.PasswordEnabled { return errors.New("password not enabled — use an account with password login") }

Type guard

func accountAllowsPassword(p PrepareLoginResp) bool { return p.PasswordEnabled && !p.WebauthnEnabled }

Try / catch

if err := d.login(); err != nil {
    switch err.Error() {
    case "password not enabled":
        return errors.New("target account has no password login; pick another account")
    }
    return err
}

Prevention

When it happens

Trigger: prepareLogin.PasswordEnabled == false. Occurs when the account authenticates exclusively via WebAuthn/passkey, OAuth/OIDC only, or the admin disabled password authentication site-wide.

Common situations: Passkey-only accounts; SSO-first deployments; user typo in email leading to a prepare response for a non-existent user; admin policy forbidding passwords.

Related errors

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/34a9befd37cb2b03. Report an issue: GitHub.