{"record":{"id":"03d41a2e4b90b301","repo":"gotify/server","slug":"user-does-not-exist-and-auto-registration-is-disab","errorCode":null,"errorMessage":"user does not exist and auto-registration is disabled","messagePattern":"user does not exist and auto-registration is disabled","errorType":"http","errorClass":null,"httpStatus":403,"severity":"warning","filePath":"api/oidc.go","lineNumber":506,"sourceCode":"\t}\n\tif user.OIDCID != nil {\n\t\tlog.Warn().Str(\"oidc_id\", oidcID).Str(\"bound_oidc_id\", *user.OIDCID).Str(\"username\", user.Name).Msg(\"OIDC login rejected: the username is already bound to a different OIDC identity\")\n\t\treturn nil, http.StatusForbidden, fmt.Errorf(\"the user %s is already bound to a different OIDC identity\", user.Name)\n\t}\n\tuser.OIDCID = &oidcID\n\tif len(a.GroupsAdmin) > 0 {\n\t\tuser.Admin = hasAdminGroup\n\t}\n\tif err := a.DB.UpdateUser(user); err != nil {\n\t\treturn nil, http.StatusInternalServerError, fmt.Errorf(\"failed to bind user to OIDC identity: %w\", err)\n\t}\n\tlog.Warn().Str(\"oidc_id\", oidcID).Str(\"username\", user.Name).Bool(\"admin\", user.Admin).Msg(\"OIDC link by username\")\n\treturn user, 0, nil\n}\n\nfunc (a *OIDCAPI) registerUser(username, oidcID string, hasAdminGroup bool) (*model.User, int, error) {\n\tif !a.AutoRegister {\n\t\treturn nil, http.StatusForbidden, errors.New(\"user does not exist and auto-registration is disabled\")\n\t}\n\tuser := &model.User{\n\t\tName:   username,\n\t\tPass:   nil,\n\t\tOIDCID: &oidcID,\n\t}\n\n\tif len(a.GroupsAdmin) > 0 {\n\t\tuser.Admin = hasAdminGroup\n\t}\n\n\tif err := a.DB.CreateUser(user); err != nil {\n\t\treturn nil, http.StatusInternalServerError, fmt.Errorf(\"failed to create user: %w\", err)\n\t}\n\tlog.Info().Str(\"oidc_id\", oidcID).Str(\"username\", user.Name).Bool(\"admin\", user.Admin).Msg(\"OIDC auto registration\")\n\tif err := a.UserChangeNotifier.fireUserAdded(user.ID); err != nil {\n\t\tlog.Error().Err(err).Uint(\"user_id\", user.ID).Msg(\"Could not notify user change\")\n\t}","sourceCodeStart":488,"sourceCodeEnd":524,"githubUrl":"https://github.com/gotify/server/blob/14bfc256276775c425f988d621dccfe705de18ac/api/oidc.go#L488-L524","documentation":"registerUser throws 403 'user does not exist and auto-registration is disabled' when an OIDC identity maps to no existing Gotify user and GOTIFY_OIDC_AUTOREGISTER is false. Gotify refuses to create the account, so login fails.","triggerScenarios":"First login of a new IdP user when auto-registration is disabled and no existing user matches by OIDC ID or (if link-by-username enabled) by username.","commonSituations":"Fresh Gotify deployment with OIDC enabled but AUTOREGISTER unset; new employee logging in before an admin created their Gotify account; provider tenant change causing usernames not to match existing accounts.","solutions":["Create the user in Gotify in advance with the matching username (and link-by-username enabled) so the identity binds on first login.","Set GOTIFY_OIDC_AUTOREGISTER=true if auto-creating accounts is acceptable.","Have an admin provision the account, then have the user log in again.","Verify GOTIFY_OIDC_LINK_BY_USERNAME settings if you expect an existing account to be matched."],"exampleFix":"// before\nGOTIFY_OIDC_AUTOREGISTER=false // new IdP user blocked\n// after\nGOTIFY_OIDC_AUTOREGISTER=true\n// or: create the user in Gotify first, then log in","handlingStrategy":"fallback","validationCode":"if (!process.env.GOTIFY_OIDC_AUTOREGISTER) {\n  const exists = await userExistsByUsername(claims.preferred_username);\n  if (!exists) console.warn('user will be rejected; provision account or enable GOTIFY_OIDC_AUTOREGISTER');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await oidcLogin();\n} catch (e) {\n  if (e.response?.status === 403 && /auto-registration is disabled/.test(e.response.data)) {\n    await provisionUser(username); // admin API/manual step, then retry login once\n  } else throw e;\n}","preventionTips":["Pre-provision Gotify users matching IdP usernames.","Enable GOTIFY_OIDC_AUTOREGISTER for self-service onboarding.","Document the provisioning step for new-user onboarding.","Verify link-by-username config if accounts should match."],"tags":["oidc","http-403","configuration","provisioning"],"backgroundTag":"user-auto-registration-disabled","analyzedSha":"14bfc256276775c425f988d621dccfe705de18ac","analyzedAt":"2026-09-05T12:52:36.781Z","contentChangedAt":"2026-09-05T12:52:36.781Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}