What causes "failed to get shadowsocks user" in XTLS/Xray-core?

Set each user's method to the inbound's 2022 method and each user's key to a correctly sized base64 PSK-derived value.

failed to get shadowsocks user

Error message

failed to get shadowsocks user

What it means

Multi-user 2022 inbound equivalent of [628]: while converting config.Users to memory users, one ToMemoryUser() call failed and the whole inbound build aborts (AtError). Note this handler auto-assigns a synthetic email (unnamed-user-<i>-<uuid>) when email is blank, so the failure is about the account itself — bad method/cipher per user — not about missing emails.

Source

Thrown at proxy/shadowsocks_2022/inbound_multi.go:62

}

func NewMultiServer(ctx context.Context, config *MultiUserServerConfig) (*MultiUserInbound, error) {
	networks := config.Network
	if len(networks) == 0 {
		networks = []net.Network{
			net.Network_TCP,
			net.Network_UDP,
		}
	}
	memUsers := []*protocol.MemoryUser{}
	for i, user := range config.Users {
		if user.Email == "" {
			u := uuid.New()
			user.Email = "unnamed-user-" + strconv.Itoa(i) + "-" + u.String()
		}
		u, err := user.ToMemoryUser()
		if err != nil {
			return nil, errors.New("failed to get shadowsocks user").Base(err).AtError()
		}
		memUsers = append(memUsers, u)
	}

	inbound := &MultiUserInbound{
		networks: networks,
		users:    memUsers,
	}
	if config.Key == "" {
		return nil, errors.New("missing key")
	}
	psk, err := base64.StdEncoding.DecodeString(config.Key)
	if err != nil {
		return nil, errors.New("parse config").Base(err)
	}
	service, err := shadowaead_2022.NewMultiService[int](config.Method, psk, 500, inbound, nil)
	if err != nil {
		return nil, errors.New("create service").Base(err)

View on GitHub (pinned to 7d214f8b09)

Solutions

Set each user's method to the inbound's 2022 method and each user's key to a correctly sized base64 PSK-derived value.
Remember the multi inbound structure: server-level key in `key`, per-user keys under users[].
Validate with xray run -test and fix the user flagged by the base error.

Example fix

// before
"users": [ { "email": "u1", "method": "aes-128-gcm", "password": "..." } ]
// after (shadowsocks-2022 multi)
"users": [ { "email": "u1", "method": "2022-blake3-aes-128-gcm", "password": "<base64-16B-key>" } ]

Defensive patterns

Strategy: validation

Validate before calling

for i, u := range config.Users {
  if !isSS2022Method(u.Method) {
    return fmt.Errorf("user %d (%s): method %q is not a shadowsocks-2022 method", i, u.Email, u.Method)
  }
}

Type guard

func isSS2022Method(m string) bool { /* see error 633 */ return false }

Try / catch

u, err := user.ToMemoryUser()
if err != nil {
  return fmt.Errorf("user %q invalid (check method/key): %w", user.Email, err)
}

Prevention

Give every user entry an explicit email even though the handler auto-generates one.
Validate each user's method and key length before inbound build.

When it happens

Trigger: NewMultiUserInbound construction where a user entry in a shadowsocks-2022 multi-user config has an invalid method (non-2022 cipher reaching the account layer) or otherwise fails account materialization.

Common situations: Mixing classic-AEAD per-user entries into a shadowsocks-2022 multi config; panels writing aes-256-gcm into user entries; per-user keys of wrong length for the inbound method.

Related errors

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/bbd0c40fc5368959. Report an issue: GitHub.