BookStackApp/BookStack · error · UserRegistrationException

auth.registrations_disabled

Error message

auth.registrations_disabled

What it means

RegistrationService::ensureRegistrationAllowed() throws UserRegistrationException with the translated 'auth.registrations_disabled' message when standard (non-external) user registration is not permitted. It guards flows that attempt to create a new local account while REGISTRATION_ENABLED is false.

Source

Thrown at app/Access/RegistrationService.php:31

use Illuminate\Support\Str;

class RegistrationService
{
    public function __construct(
        protected UserRepo $userRepo,
        protected EmailConfirmationService $emailConfirmationService,
    ) {
    }

    /**
     * Check if registrations are allowed in the app settings.
     *
     * @throws UserRegistrationException
     */
    public function ensureRegistrationAllowed()
    {
        if (!$this->registrationAllowed()) {
            throw new UserRegistrationException(trans('auth.registrations_disabled'), '/login');
        }
    }

    /**
     * Check if standard BookStack User registrations are currently allowed.
     * Does not prevent external-auth based registration.
     */
    protected function registrationAllowed(): bool
    {
        $authMethod = config('auth.method');
        $authMethodsWithRegistration = ['standard'];

        return in_array($authMethod, $authMethodsWithRegistration) && setting('registration-enabled');
    }

    /**
     * Attempt to find a user in the system otherwise register them as a new
     * user. For use with external auth systems since password is auto-generated.

View on GitHub (pinned to 18f8469a1c)

Solutions

1. If self-registration should work, enable it: set REGISTRATION_ENABLED=true in .env and clear caches (php artisan cache:clear)
2. If registration should stay closed, direct users to their auth provider (OIDC/SAML/LDAP) so they are matched to existing accounts
3. Admins can create accounts manually via the Users admin page
4. Check that the external auth config is correct so external logins are treated as external (bypassing this check) rather than standard registration

Example fix

// before (.env)
REGISTRATION_ENABLED=false
// after
REGISTRATION_ENABLED=true

// Check before exposing sign-up UI or calling the flow:
$enabled = env('REGISTRATION_ENABLED', false);
if (!$enabled) {
    // hide registration links; route users to OIDC/SAML/LDAP login instead
}

try {
    $service->ensureRegistrationAllowed();
} catch (BookStack\Access\UserRegistrationException $e) {
    if (trans('auth.registrations_disabled') === $e->getMessage()) {
        return redirect('/login')->withErrors(['registration' => 'Sign-ups are disabled; use your identity provider or contact an admin']);
    }
    throw $e;
}

When it happens

Trigger: ensureRegistrationAllowed() is called and $this->registrationAllowed() returns false — i.e. the 'registration_enabled' setting is off — during a standard sign-up or a registration path that does not come from a configured external auth system.

Common situations: New users clicking 'Sign up' after an admin disabled registration; self-hosted instances with REGISTRATION_ENABLED=false in .env; users whose OIDC/SAML match fails and code falls back to a standard registration path.

Related errors

• errors.email_already_confirmed
• Provided path [{$caCertPath}] for LDAP TLS CA certs could no
• Failed to read signing key with error:
• Missing or non-matching token issuer value
• Missing required configuration "{$prop}" value

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/ec445e15183ad8fe. Report an issue: GitHub.