RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Cannot change username for federated users or users in federated rooms

What it means

setUsernameWithValidation refuses to rename federation-managed identities: the guard at setUsername.ts:42 fires when isUserNativeFederated(user) is true (account created by/for the Federation feature) or when Subscriptions.findUserFederatedRoomIds(userId) yields any room. The username is part of the cross-server federation address (user@server), so renaming would break remote addressing.

Source

Thrown at apps/meteor/server/lib/users/setUsername.ts:43

	const cursor = Subscriptions.findUserFederatedRoomIds(userId);
	const hasAny = await cursor.hasNext();
	await cursor.close();
	return hasAny;
};

export const setUsernameWithValidation = async (userId: string, username: string, joinDefaultChannelsSilenced?: boolean): Promise<void> => {
	if (!username) {
		throw new Meteor.Error('error-invalid-username', 'Invalid username', { method: 'setUsername' });
	}

	const user = await Users.findOneById(userId);

	if (!user) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'setUsername' });
	}

	if (isUserNativeFederated(user) || (await isUserInFederatedRooms(userId))) {
		throw new Meteor.Error('error-not-allowed', 'Cannot change username for federated users or users in federated rooms', {
			method: 'setUsername',
		});
	}

	if (user.username && !settings.get('Accounts_AllowUsernameChange')) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed');
	}

	if (user.username === username || (user.username && user.username.toLowerCase() === username.toLowerCase())) {
		return;
	}

	if (!validateUsername(username)) {
		throw new Meteor.Error(
			'username-invalid',
			`${_.escape(username)} is not a valid username, use only letters, numbers, dots, hyphens and underscores`,
		);
	}

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Hide the username-edit affordance for federated users instead of letting them hit the error
  2. Have the user leave all federated rooms first, then retry the rename
  3. If federation is not intentionally used, disable/remove the Federation feature so isUserInFederatedRooms no longer matches

Example fix

// before
await setUsernameWithValidation(userId, newUsername); // throws error-not-allowed for federated users

// after
if (isUserNativeFederated(user) || (await Subscriptions.findUserFederatedRoomIds(userId).hasNext())) {
  throw new Meteor.Error('error-not-allowed', 'Username locked by federation');
}
await setUsernameWithValidation(userId, newUsername);
Defensive patterns

Strategy: validation

Validate before calling

import { isUserNativeFederated } from '@rocket.chat/core-typings';
import { Subscriptions } from '@rocket.chat/models';

const cursor = Subscriptions.findUserFederatedRoomIds(userId);
const inFederatedRoom = await cursor.hasNext();
await cursor.close();
if (isUserNativeFederated(user) || inFederatedRoom) {
  // skip the rename flow entirely
}

Try / catch

try {
  await setUsernameWithValidation(userId, username);
} catch (error) {
  if (error instanceof Meteor.Error && error.error === 'error-not-allowed' && /federated/i.test(error.reason)) {
    // show 'username locked by federation' message
  } else {
    throw error;
  }
}

Prevention

When it happens

Trigger: Calling the setUsername method for a user who has joined at least one federated room on a workspace with Federation enabled, or for a native federated user (created via first contact from a remote instance). The guard applies to admins too.

Common situations: Federation enabled (Settings > Federation) and existing users later join federated channels; imported users accidentally flagged as federated; dev workspaces restored from federated production data. Every rename attempt re-runs the check.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/ce019a1d5873878e. Report an issue: GitHub.