SigNoz/signoz · error · errors.Error

CodeUnsupported

CodeUnsupported

Error message

Users are not allowed to reset their password themselves, please contact an admin to reset your password.

What it means

ForgotPassword immediately returns TypeUnsupported when config password.reset.allow_self is false — self-service password reset is administratively disabled, so users must ask an admin.

Source

Thrown at pkg/modules/user/impluser/setter.go:340

		tokenLifetime = module.config.Password.Invite.MaxTokenLifetime
	}
	resetPasswordToken, err := types.NewResetPasswordToken(password.ID, time.Now().Add(tokenLifetime))
	if err != nil {
		return nil, err
	}

	// create a new token
	err = module.store.CreateResetPasswordToken(ctx, resetPasswordToken)
	if err != nil {
		return nil, err
	}

	return resetPasswordToken, nil
}

func (module *setter) ForgotPassword(ctx context.Context, orgID valuer.UUID, email valuer.Email, frontendBaseURL string) error {
	if !module.config.Password.Reset.AllowSelf {
		return errors.New(errors.TypeUnsupported, errors.CodeUnsupported, "Users are not allowed to reset their password themselves, please contact an admin to reset your password.")
	}

	user, err := module.getter.GetNonDeletedUserByEmailAndOrgID(ctx, email, orgID)
	if err != nil {
		if errors.Ast(err, errors.TypeNotFound) {
			return nil // for security reasons
		}
		return err
	}

	if err := user.ErrIfRoot(); err != nil {
		return errors.WithAdditionalf(err, "cannot reset password for root user")
	}

	token, err := module.GetOrCreateResetPasswordToken(ctx, user.ID)
	if err != nil {
		module.settings.Logger().ErrorContext(ctx, "failed to create reset password token", errors.Attr(err))
		return err

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Set user::password::reset::allow=true in config if self-service reset is desired
2. Have an admin perform the password reset via the admin reset API instead
3. Communicate the contact-admin process to users if self-reset is intentionally disabled

Example fix

// before
password:
  reset:
    allow: false
// after
password:
  reset:
    allow: true

err := forgotPassword(ctx, orgID, email, baseURL)
if err != nil && errors.Ast(err, errors.TypeUnsupported) {
    // show 'contact admin' UX instead of an error page
}

When it happens

Trigger: POST to the forgot-password endpoint while user module config has password.reset.allow=false. Note: this check runs before user lookup, so it fires even for nonexistent emails (unlike the not-found case which returns nil for security).

Common situations: Orgs with centralized IT-managed credentials; SSO-first deployments where local passwords are secondary; default config shipped with self-reset off.

Related errors

• ErrCodeResetPasswordTokenExpired
• ErrCodeResetPasswordTokenExpired
• ErrCodeInvalidResolver
• ErrCodeInvalidGatewayConfig
• invalid_input

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/5eab2cbb90d444b8. Report an issue: GitHub.