RocketChat/Rocket.Chat · error · Meteor.Error

Edit_Federated_User_Not_Allowed

Edit_Federated_User_Not_Allowed

Error message

Not possible to edit a federated user

What it means

saveUser throws Edit_Federated_User_Not_Allowed when the user being modified (oldUserData found by userData._id) has the federated flag set. Federated users' identity is owned by their home server, so the local server refuses to edit them through saveUser.

Solutions

  1. Edit the user on their home (origin) server instead; the change federates back
  2. Filter federated users out of bulk edit/sync jobs (check isUserFederated(user) before calling saveUser)
  3. If the account must be neutralized locally, deactivate it rather than edit it

Example fix

// before
await saveUser(actorId, { _id: targetId, name: 'New Name' }); // federated -> error

// after
const target = await Users.findOneById(targetId, { projections: { federated: 1 } });
if (isUserFederated(target)) {
  throw new Error('Edit this user on its home server');
}
await saveUser(actorId, { _id: targetId, name: 'New Name' });
Defensive patterns

Strategy: validation

Validate before calling

const target = await Users.findOneById(userData._id, { projections: { federated: 1 } });
if (target && isUserFederated(target)) {
  throw new Error('Edit federated users on their home server');
}
await saveUser(actorId, userData);

Type guard

const isFederatedTarget = (u: IUser | null): boolean => !!u && isUserFederated(u);

Try / catch

try {
  await saveUser(actorId, userData);
} catch (e) {
  if (isMeteorErrorCode(e, 'Edit_Federated_User_Not_Allowed')) {
  	// route the edit to the user's home server instead
  }
}

Prevention

When it happens

Trigger: Admin console or REST call that updates a federated user's profile fields; user-import or sync jobs that iterate all users including federated ones.

Common situations: Federation enabled for external collaboration and admins later trying to 'clean up' remote-participating accounts; sync connectors not filtering on the federated flag.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/16e434c63c56cac0. Report an issue: GitHub.

Appendix: source

Thrown at apps/meteor/server/lib/users/saveUser/saveUser.ts:80

	auditStore?: UserChangedAuditStore;
};

const findUserById = async (uid: IUser['_id']): Promise<IUser> => {
	const user = await Users.findOneById(uid);
	if (!user) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user');
	}

	return user;
};

const _saveUser = (session?: ClientSession) =>
	async function (userId: IUser['_id'], userData: SaveUserData, options?: SaveUserOptions) {
		const performedBy = await findUserById(userId);

		const oldUserData = userData._id && (await Users.findOneById(userData._id));
		if (oldUserData && isUserFederated(oldUserData)) {
			throw new Meteor.Error('Edit_Federated_User_Not_Allowed', 'Not possible to edit a federated user');
		}

		await validateUserData(userId, userData);

		await callbacks.run('beforeSaveUser', {
			user: userData,
			oldUser: oldUserData,
		});

		let sendPassword = false;

		if (userData.hasOwnProperty('setRandomPassword')) {
			if (userData.setRandomPassword) {
				userData.password = generatePassword();
				userData.requirePasswordChange = true;
				sendPassword = true;
			}

View on GitHub (pinned to b2c16d5842)