RocketChat/Rocket.Chat · error · Meteor.Error

registration-disabled-authentication-services

registration-disabled-authentication-services

Error message

User registration is disabled for authentication services

What it means

Accounts.validateNewUser throws registration-disabled-authentication-services when a new user is being created by a non-password auth service (OAuth/SAML/CAS), Accounts_Registration_AuthenticationServices_Enabled is false, and LDAP_Enable is false. It blocks automatic account provisioning on first SSO sign-in when admins have closed registration for authentication services.

Source

Thrown at apps/meteor/server/lib/auth/startup.js:491

	return true;
};

Accounts.validateLoginAttempt(function (...args) {
	// Depends on meteor support for Async
	return validateLoginAttemptAsync.call(this, ...args);
});

Accounts.validateNewUser((user) => {
	if (user.type === 'visitor') {
		return true;
	}

	if (
		settings.get('Accounts_Registration_AuthenticationServices_Enabled') === false &&
		settings.get('LDAP_Enable') === false &&
		!(user.services && user.services.password)
	) {
		throw new Meteor.Error('registration-disabled-authentication-services', 'User registration is disabled for authentication services');
	}

	return true;
});

Accounts.validateNewUser((user) => {
	if (user.type === 'visitor') {
		return true;
	}

	let domainWhiteList = settings.get('Accounts_AllowedDomainsList');
	if (_.isEmpty(domainWhiteList?.trim())) {
		return true;
	}

	domainWhiteList = domainWhiteList.split(',').map((domain) => domain.trim());

	if (user.emails && user.emails.length > 0) {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Enable Accounts_Registration_AuthenticationServices_Enabled (Administration -> Accounts -> Registration)
2. Or have the user register with email/password first, then connect the auth service to the same account
3. If users come from LDAP, enable LDAP so the LDAP branch of the check passes
4. Pre-create/invite users via admin APIs instead of relying on SSO auto-registration

const ssoRegistrationAllowed =
  settings.get('Accounts_Registration_AuthenticationServices_Enabled') === true ||
  settings.get('LDAP_Enable') === true;
// surface a configuration warning to admins before wiring SSO when false

try {
  await loginWithService(...);
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'registration-disabled-authentication-services') {
    // first-time SSO provisioning blocked: instruct admin to enable the setting or pre-create the account
  }
  throw e;
}

When it happens

Trigger: First login via GitHub/Google/SAML/custom OAuth on a workspace where Accounts_Registration_AuthenticationServices_Enabled is false: the login handler tries to create the user and validateNewUser rejects it because user.services has no password entry.

Common situations: Admins disable 'Registration with authentication services' intending only to stop public password signup and unknowingly break SSO onboarding; a user tries SSO before any password account exists for them.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• error-parameter-required
• error-challenge-not-found
• error-challenge-expired
• error-invalid-challenge-method
• totp-max-attempts

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/0ddbb171f41bb1b8. Report an issue: GitHub.