RocketChat/Rocket.Chat · error · Meteor.Error

error-user-is-not-activated

error-user-is-not-activated

Error message

User is not activated

What it means

validateLoginAttempt throws error-user-is-not-activated when !!login.user.active !== true, i.e. the account is inactive. Accounts become inactive when an admin deactivates them, when Accounts_ManuallyApproveNewUsers is enabled and registration is pending approval (onCreateUserAsync sets active=false with inactiveReason='pending_approval'), or when directory/OAuth sync flips the flag.

Source

Thrown at apps/meteor/server/lib/auth/startup.js:439

		});
	}

	if (login.allowed !== true) {
		return login.allowed;
	}

	if (login.user.type === 'visitor') {
		return true;
	}

	if (login.user.type === 'app') {
		throw new Meteor.Error('error-app-user-is-not-allowed-to-login', 'App user is not allowed to login', {
			function: 'Accounts.validateLoginAttempt',
		});
	}

	if (!!login.user.active !== true) {
		throw new Meteor.Error('error-user-is-not-activated', 'User is not activated', {
			function: 'Accounts.validateLoginAttempt',
		});
	}

	if (!login.user.roles || !Array.isArray(login.user.roles)) {
		throw new Meteor.Error('error-user-has-no-roles', 'User has no roles', {
			function: 'Accounts.validateLoginAttempt',
		});
	}

	if (login.user.roles.includes('admin') === false && login.type === 'password' && settings.get('Accounts_EmailVerification') === true) {
		const validEmail = login.user.emails.filter((email) => email.verified === true);
		if (validEmail.length === 0) {
			throw new Meteor.Error('error-invalid-email', 'Invalid email __email__');
		}
	}

	login = await callbacks.run('onValidateLogin', login);

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Administration -> Users -> open the user -> set Active to true (this also approves pending_approval users)
  2. If Accounts_ManuallyApproveNewUsers is on, review the pending users list or disable manual approval
  3. Check directory sync / LDAP / custom OAuth callbacks that set active:false so they stop re-deactivating the account
Defensive patterns

Strategy: validation

Validate before calling

const user = await Users.findOneByUsername(username, { projection: { active: 1, inactiveReason: 1 } });
if (!user?.active) {
  throw new Error(
    user?.inactiveReason === 'pending_approval'
      ? 'Account pending admin approval'
      : 'Account deactivated; ask an administrator to activate it',
  );
}

Type guard

const isActiveUser = (u: { active?: boolean } | null | undefined): u is { active: true } =>
  u?.active === true;

Try / catch

try {
  await loginWithPassword(user, password);
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-user-is-not-activated') {
    // route the user to 'contact admin / pending approval' messaging; do not retry
  }
  throw e;
}

Prevention

When it happens

Trigger: Password or token login as a deactivated user; login immediately after self-registration on a workspace with Accounts_ManuallyApproveNewUsers enabled and before an admin approves the account.

Common situations: New signups stuck in the pending-approval queue nobody reviews; admin deactivation used as a soft ban; LDAP/custom-OAuth provisioning marking users inactive.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/097e58110a06661e. Report an issue: GitHub.