SigNoz/signoz · critical

invalid_input

invalid_input

Error message

root user is not enabled, impersonation identity provider will not be able to resolve any identity

What it means

The impersonation identity provider constructor requires the root user to be enabled, since every impersonated request resolves to the root user's identity. Without user.root.enabled=true, construction fails at startup.

Source

Thrown at pkg/identn/impersonationidentn/provider.go:39

	userConfig user.Config

	mu       sync.RWMutex
	identity *authtypes.Identity
}

func NewFactory(orgGetter organization.Getter, userGetter user.Getter, userConfig user.Config) factory.ProviderFactory[identn.IdentN, identn.Config] {
	return factory.NewProviderFactory(factory.MustNewName(authtypes.IdentNProviderImpersonation.StringValue()), func(ctx context.Context, providerSettings factory.ProviderSettings, config identn.Config) (identn.IdentN, error) {
		return New(ctx, providerSettings, config, orgGetter, userGetter, userConfig)
	})
}

func New(ctx context.Context, providerSettings factory.ProviderSettings, config identn.Config, orgGetter organization.Getter, userGetter user.Getter, userConfig user.Config) (identn.IdentN, error) {
	settings := factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/identn/impersonationidentn")

	settings.Logger().WarnContext(ctx, "impersonation identity provider is enabled, all requests will impersonate the root user")

	if !userConfig.Root.Enabled {
		return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "root user is not enabled, impersonation identity provider will not be able to resolve any identity")
	}

	return &provider{
		config:     config,
		settings:   settings,
		orgGetter:  orgGetter,
		userGetter: userGetter,
		userConfig: userConfig,
	}, nil
}

func (provider *provider) Name() authtypes.IdentNProvider {
	return authtypes.IdentNProviderImpersonation
}

func (provider *provider) Test(_ *http.Request) bool {
	return true
}

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Set user.root.enabled=true (and provide root user credentials/org config) in settings
2. Or switch to a different identn provider
3. Validate config with the root-user section present before deploy

Example fix

# before
identn:
  provider: impersonationidentn
user:
  root:
    enabled: false
# after
identn:
  provider: impersonationidentn
user:
  root:
    enabled: true

if identnCfg.Provider == "impersonationidentn" && !userCfg.Root.Enabled { return fmt.Errorf("enable user.root for impersonation") }

func canUseImpersonation(idcfg identn.Config, ucfg user.Config) bool { return idcfg.Provider == "impersonationidentn" && ucfg.Root.Enabled }

p, err := impersonationidentn.New(ctx, settings, idcfg, og, ug, ucfg)
if err != nil { log.Fatalf("identn init failed: %v", err) }

When it happens

Trigger: Configuring identn provider as impersonationidentn while user.root.enabled is false or unset.

Common situations: Local/dev setups enabling impersonation for easy testing without enabling the root user; fresh installs copying partial config snippets.

Related errors

• invalid_input
• gateway_unsupported
• root_user_operation_unsupported
• couldn't prepare request: %w
• ErrCodeServiceFailed

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/cbfa39e32fe486e1. Report an issue: GitHub.