RocketChat/Rocket.Chat · error · MeteorError

error-not-authorized-federation

error-not-authorized-federation

Error message

Not authorized to access federation

What it means

Thrown by the `beforeAddUserToRoom` federation hook when the invitee is not a native-federated user AND `FederationMatrix.canUserAccessFederation(user)` returns false. Access is denied if the user lacks the `access-federation` permission, or (when domain validation is enabled) has no verified email matching the server's domain. It is a `MeteorError` with code `error-not-authorized-federation`.

Source

Thrown at apps/meteor/ee/server/hooks/federation/index.ts:145

		if (subscription) {
			if (!isBannedSubscription(subscription)) {
				return;
			}
			// For federated rooms, unban requires a Matrix kick (leave) followed by a new invite.
			// Remove the subscription so the unban propagates to Matrix via the afterUnbanFromRoom callback,
			// then let the flow continue to create a new INVITED subscription via the beforeAddUserToRoom hook.
			await Subscriptions.removeById(subscription._id);

			await Message.saveSystemMessage('user-unbanned', room._id, user.username, inviter);

			void notifyOnSubscriptionChanged(subscription, 'removed');
			void notifyOnRoomChangedById(room._id);

			await afterUnbanFromRoomCallback.run({ unbannedUser: user, userWhoUnbanned: inviter }, room);
		}

		if (!isUserNativeFederated(user) && !(await FederationMatrix.canUserAccessFederation(user))) {
			throw new MeteorError('error-not-authorized-federation', 'Not authorized to access federation');
		}

		// If inviter is federated, the invite came from an external transaction.
		// Don't propagate back to Matrix (it was already processed at origin server).
		if (isUserNativeFederated(inviter)) {
			return;
		}

		await FederationMatrix.inviteUsersToRoom(room, [user.username], inviter);

		// after invite is sent we create the invite subscriptions
		// TODO this may be not needed if we receive the emit for the invite event from matrix
		await Room.createUserSubscription({
			ts: new Date(),
			room,
			userToBeAdded: user,
			inviter,
			status: 'INVITED',

View on GitHub (pinned to f9d3ec372b)

Solutions

1. Grant the `access-federation` permission to the user (or their role).
2. If domain validation is enabled, ensure the user has a verified email at the server's domain.
3. Review the `validateUserDomain` federation setting and the user's verified email list.

import { Authorization } from '../../../../server/authorization';

async function userCanAccessFederation(user: IUser): Promise<boolean> {
	return Authorization.hasPermission({ _id: user._id, roles: user.roles }, 'access-federation');
}

function isNotAuthorizedFederationError(e: unknown): boolean {
	return e instanceof Meteor.Error && (e as Meteor.Error).error === 'error-not-authorized-federation';
}

try {
	await beforeAddUserToRoom.run({ user, inviter }, room);
} catch (e) {
	if (e instanceof Meteor.Error && e.error === 'error-not-authorized-federation') {
		// grant access-federation permission or fix domain validation
	}
	throw e;
}

When it happens

Trigger: Inviting a local (non-native-federated) user into a federated room when the user is missing the `access-federation` permission, or `validateUserDomain` is enabled and none of the user's verified emails match the server name.

Common situations: Permission `access-federation` was revoked from the user's role; federation domain restriction enabled but user's email domain doesn't match; new SSO/LDAP user without federation permission assigned.

Related errors

• error-invalid-room
• error-federated-users-in-non-federated-rooms
• error-username-reserved-by-bridge
• Marketplace_Failed_To_Fetch_Categories
• error-essential-app-disabled

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/6f1358f0b4dae59f. Report an issue: GitHub.