RocketChat/Rocket.Chat · error · Meteor.Error

Edit_Federated_User_Not_Allowed

Edit_Federated_User_Not_Allowed

Error message

Not possible to edit a federated user

What it means

saveUser throws Edit_Federated_User_Not_Allowed when the user being modified (oldUserData found by userData._id) has the federated flag set. Federated users' identity is owned by their home server, so the local server refuses to edit them through saveUser.

Source

Thrown at apps/meteor/server/lib/users/saveUser/saveUser.ts:80

	auditStore?: UserChangedAuditStore;
};

const findUserById = async (uid: IUser['_id']): Promise<IUser> => {
	const user = await Users.findOneById(uid);
	if (!user) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user');
	}

	return user;
};

const _saveUser = (session?: ClientSession) =>
	async function (userId: IUser['_id'], userData: SaveUserData, options?: SaveUserOptions) {
		const performedBy = await findUserById(userId);

		const oldUserData = userData._id && (await Users.findOneById(userData._id));
		if (oldUserData && isUserFederated(oldUserData)) {
			throw new Meteor.Error('Edit_Federated_User_Not_Allowed', 'Not possible to edit a federated user');
		}

		await validateUserData(userId, userData);

		await callbacks.run('beforeSaveUser', {
			user: userData,
			oldUser: oldUserData,
		});

		let sendPassword = false;

		if (userData.hasOwnProperty('setRandomPassword')) {
			if (userData.setRandomPassword) {
				userData.password = generatePassword();
				userData.requirePasswordChange = true;
				sendPassword = true;
			}

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Edit the user on their home (origin) server instead; the change federates back
  2. Filter federated users out of bulk edit/sync jobs (check isUserFederated(user) before calling saveUser)
  3. If the account must be neutralized locally, deactivate it rather than edit it

Example fix

// before
await saveUser(actorId, { _id: targetId, name: 'New Name' }); // federated -> error

// after
const target = await Users.findOneById(targetId, { projections: { federated: 1 } });
if (isUserFederated(target)) {
  throw new Error('Edit this user on its home server');
}
await saveUser(actorId, { _id: targetId, name: 'New Name' });
Defensive patterns

Strategy: validation

Validate before calling

const target = await Users.findOneById(userData._id, { projections: { federated: 1 } });
if (target && isUserFederated(target)) {
  throw new Error('Edit federated users on their home server');
}
await saveUser(actorId, userData);

Type guard

const isFederatedTarget = (u: IUser | null): boolean => !!u && isUserFederated(u);

Try / catch

try {
  await saveUser(actorId, userData);
} catch (e) {
  if (isMeteorErrorCode(e, 'Edit_Federated_User_Not_Allowed')) {
  	// route the edit to the user's home server instead
  }
}

Prevention

When it happens

Trigger: Admin console or REST call that updates a federated user's profile fields; user-import or sync jobs that iterate all users including federated ones.

Common situations: Federation enabled for external collaboration and admins later trying to 'clean up' remote-participating accounts; sync connectors not filtering on the federated flag.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/16e434c63c56cac0. Report an issue: GitHub.