RocketChat/Rocket.Chat · error · Error

One or more of the users have been assigned invalid roles.

Error message

One or more of the users have been assigned invalid roles.

What it means

Thrown by addUsers when validateRoleList() rejects one or more roles referenced by the imported users (including default roles). Before inserting, the service collects the union of all user roles and validates them against the workspace's existing roles; any unknown role id/name fails the whole batch.

Source

Thrown at apps/meteor/server/services/import/service.ts:136

		this.assertsValidStateForNewData(operation);

		const defaultRoles = getNewUserRoles();
		const userRoles = new Set<string>(defaultRoles);
		for await (const user of users) {
			if (!user.emails?.some((value) => value) || !user.importIds?.some((value) => value)) {
				throw new Error('Users are missing required data.');
			}

			if (user.roles?.length) {
				for (const roleId of user.roles) {
					userRoles.add(roleId);
				}
			}
		}

		if (userRoles.size > 0 && !(await validateRoleList([...userRoles]))) {
			throw new Error('One or more of the users have been assigned invalid roles.');
		}

		await ImportData.col.insertMany(
			users.map((data) => ({
				_id: new ObjectId().toHexString(),
				data: {
					...data,
					roles: data.roles ? [...new Set([...data.roles, ...defaultRoles])] : defaultRoles,
				},
				dataType: 'user',
				_updatedAt: new Date(),
			})),
		);

		await Imports.increaseTotalCount(operation._id, 'users', users.length);
		await Imports.setOperationStatus(operation._id, 'importer_user_selection');
	}

View on GitHub (pinned to b2c16d5842)

Solutions

1. Create the missing roles on the target workspace before importing
2. Map source role names to existing target roles in the importer configuration
3. Strip unknown roles from user records when they are not needed

Example fix

// before
await service.addUsers(usersWithSourceRoles);

// after
const known = new Set(await Roles.find({}, { fields: { _id: 1 } }).map((r) => r._id));
const sanitized = users.map((u) => ({ ...u, roles: u.roles?.filter((r) => known.has(r)) }));
await service.addUsers(sanitized);

const roles = [...new Set(users.flatMap((u) => u.roles ?? []))];
if (roles.length && !(await validateRoleList(roles))) {
  throw new Error(`unknown roles: ${roles.join(', ')}`);
}
await service.addUsers(users);

async function allRolesExist(roles: string[]): Promise<boolean> {
  const known = new Set((await Roles.find({}, { fields: { _id: 1 } }).fetch()).map((r) => r._id));
  return roles.every((r) => known.has(r));
}

When it happens

Trigger: Importing users whose roles exist in the source workspace but not in the target; role renames between workspaces; scoped/EE roles missing on a Community target; default role list corrupted.

Common situations: Cross-workspace migrations without role pre-creation; imports from systems with custom role models; fresh installs that never created the custom roles used by the source.

Related errors

• Invalid Selection data provided to the importer.
• Users are missing required data.
• error-duplicate-role-names-not-allowed
• error-invalid-scope
• error-invalid-scope

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/2eb71072e2cef7d8. Report an issue: GitHub.