RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

checkUsernameAvailabilityWithValidation throws error-not-allowed (method 'setUsername') when the user already has a username and the workspace setting Accounts_AllowUsernameChange is disabled. The server deliberately blocks renames after initial registration; only first-time username assignment is permitted.

Source

Thrown at apps/meteor/server/lib/users/checkUsernameAvailability.ts:35

	usernameBlackList = ['all', 'here'].concat(value.split(',')).map(toRegExp);
});

const usernameIsBlocked = (username: string, usernameBlackList: RegExp[]): boolean | number =>
	usernameBlackList.length && usernameBlackList.some((restrictedUsername) => restrictedUsername.test(escapeRegExp(username).trim()));

export const checkUsernameAvailabilityWithValidation = async function (userId: string, username: string): Promise<boolean> {
	if (!username) {
		throw new Meteor.Error('error-invalid-username', 'Invalid username', { method: 'setUsername' });
	}

	const user = await Users.findOneById(userId, { projection: { username: 1 } });

	if (!user) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'setUsername' });
	}

	if (user.username && !settings.get('Accounts_AllowUsernameChange')) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'setUsername' });
	}

	if (user.username === username) {
		return true;
	}
	return checkUsernameAvailability(username);
};

export const checkUsernameAvailability = async function (username: string, type: UsernameAvailabilityCheckType = 'user'): Promise<boolean> {
	if (usernameIsBlocked(username, usernameBlackList) || !validateName(username)) {
		throw new Meteor.Error('error-blocked-username', `${_.escape(username)} is blocked and can't be used!`, {
			method: 'checkUsernameAvailability',
			field: username,
		});
	}

	// Make sure no users are using this username
	const existingUser = await Users.findOneByUsernameIgnoringCase(username, {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Enable Accounts_AllowUsernameChange in Administration > Settings > Accounts if self-service renames are wanted
2. Otherwise have an admin change the username, or manage it in the upstream identity provider (LDAP/SAML mapping)
3. Hide the username edit field in the UI when the setting is off so users never hit the error

Example fix

// before
if (user.username !== newUsername) {
  Meteor.call('setUsername', newUsername);
}

// after
const canChange = settings.get('Accounts_AllowUsernameChange') || !user.username;
if (canChange && user.username !== newUsername) {
  Meteor.call('setUsername', newUsername);
}

const canRename = !currentUser.username || settings.get('Accounts_AllowUsernameChange');
if (!canRename) {
  disableUsernameEdit();
  return;
}
await checkUsernameAvailabilityWithValidation(userId, newUsername);

try {
  await checkUsernameAvailabilityWithValidation(userId, newUsername);
} catch (e) {
  if (isMeteorErrorCode(e, 'error-not-allowed')) {
  	showNotice('Username changes are disabled by your administrator');
  }
}

When it happens

Trigger: Any setUsername attempt by an already-named user on a workspace where Admin > Settings > Accounts has 'Allow Username Change' off (the default hardening posture for many enterprises).

Common situations: End users trying to rename themselves after registration on a locked-down workspace; SAML/LDAP-managed installations where identity comes from the upstream provider and renames are intentionally disabled.

Related errors

• error-blocked-username
• error-input-is-not-a-valid-field
• The setting "${id}" is not readable.
• The setting "${setting.id}" is not readable.
• error-action-not-allowed

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/4081a2ec4716da8b. Report an issue: GitHub.