{"record":{"id":"015d3b2217d217de","repo":"theonedev/onedev","slug":"cannot-add-ssh-key-for-disabled-user","errorCode":null,"errorMessage":"Cannot add ssh key for disabled user","messagePattern":"Cannot add ssh key for disabled user","errorType":"http","errorClass":"ExplicitException","httpStatus":400,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java","lineNumber":601,"sourceCode":"\n\t\tif (!getAuthUser().equals(user)) {\n\t\t\tvar newAuditContent = VersionedXmlDoc.fromBean(queriesAndWatches).toXML();\n\t\t\tauditService.audit(null, \"changed queries and watches of account \\\"\" + user.getName() + \"\\\" via RESTful API\", oldAuditContent, newAuditContent);\n\t\t}\n\n\t\treturn Response.ok().build();\n    }\n\t\n\t@Api(order=2200)\n\t@Path(\"/{userId}/ssh-keys\")\n\t@POST\n\tpublic Long addSshKey(@PathParam(\"userId\") Long userId, @NotNull String content) {\n\t\tUser user = userService.load(userId);\n\t\tif (!SecurityUtils.isAdministrator() && !user.equals(getAuthUser()))\n\t\t\tthrow new UnauthorizedException();\n\t\t\n\t\tif (user.isDisabled())\n\t\t\tthrow new ExplicitException(\"Cannot add ssh key for disabled user\");\n\n\t\tSshKey sshKey = new SshKey();\n\t\tsshKey.setContent(content);\n\t\tsshKey.setCreatedAt(new Date());\n\t\tsshKey.setOwner(user);\n\t\tsshKey.generateFingerprint();\n        \n\t\tsshKeyService.create(sshKey);\n\n\t\tif (!getAuthUser().equals(user)) {\n\t\t\tvar newAuditContent = VersionedXmlDoc.fromBean(sshKey).toXML();\n\t\t\tauditService.audit(null, \"added ssh key to account \\\"\" + user.getName() + \"\\\" via RESTful API\", null, newAuditContent);\n\t\t}\n\n\t\treturn sshKey.getId();\n\t}\n\t\n\t@Api(order=2300)","sourceCodeStart":583,"sourceCodeEnd":619,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java#L583-L619","documentation":"OneDev throws this ExplicitException from the addSshKey REST endpoint when attempting to add an SSH public key to a disabled user account. Disabled accounts cannot authenticate, so attaching new SSH credentials to them is disallowed. Only admins or the user themself pass the preceding authorization check.","triggerScenarios":"POSTing an SSH key to /users/{userId}/ssh-keys where the target user has isDisabled()==true.","commonSituations":"Provisioning scripts that create users and add SSH keys in one run, where the user was created disabled or disabled by policy; re-adding keys to an offboarded account.","solutions":["Enable the user account first, then add the SSH key","Skip key provisioning for disabled users in automation","Verify the account status via getUser() before POSTing the key"],"exampleFix":"// before\nrestClient.addSshKey(userId, pubKey);\n// after\nUser u = restClient.getUser(userId);\nif (!u.isDisabled()) restClient.addSshKey(userId, pubKey);","handlingStrategy":"validation","validationCode":"User u = getUser(userId); if (u.isDisabled()) throw new SkipException(\"user disabled\");","typeGuard":"boolean canManageKeys(User u) { return u != null && !u.isDisabled(); }","tryCatchPattern":"try { addSshKey(userId, key); } catch (ExplicitException e) { log.warn(\"ssh key not added: {}\", e.getMessage()); }","preventionTips":["Verify account is active before provisioning credentials","Skip disabled users in key-provisioning automation","Re-enable account first if keys must be staged ahead of reactivation"],"tags":["rest-api","ssh-key","disabled-account"],"backgroundTag":"invalid-state-transition","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}