{"record":{"id":"0ddbb171f41bb1b8","repo":"RocketChat/Rocket.Chat","slug":"registration-disabled-authentication-services","errorCode":"registration-disabled-authentication-services","errorMessage":"User registration is disabled for authentication services","messagePattern":"User registration is disabled for authentication services","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/auth/startup.js","lineNumber":491,"sourceCode":"\treturn true;\n};\n\nAccounts.validateLoginAttempt(function (...args) {\n\t// Depends on meteor support for Async\n\treturn validateLoginAttemptAsync.call(this, ...args);\n});\n\nAccounts.validateNewUser((user) => {\n\tif (user.type === 'visitor') {\n\t\treturn true;\n\t}\n\n\tif (\n\t\tsettings.get('Accounts_Registration_AuthenticationServices_Enabled') === false &&\n\t\tsettings.get('LDAP_Enable') === false &&\n\t\t!(user.services && user.services.password)\n\t) {\n\t\tthrow new Meteor.Error('registration-disabled-authentication-services', 'User registration is disabled for authentication services');\n\t}\n\n\treturn true;\n});\n\nAccounts.validateNewUser((user) => {\n\tif (user.type === 'visitor') {\n\t\treturn true;\n\t}\n\n\tlet domainWhiteList = settings.get('Accounts_AllowedDomainsList');\n\tif (_.isEmpty(domainWhiteList?.trim())) {\n\t\treturn true;\n\t}\n\n\tdomainWhiteList = domainWhiteList.split(',').map((domain) => domain.trim());\n\n\tif (user.emails && user.emails.length > 0) {","sourceCodeStart":473,"sourceCodeEnd":509,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/auth/startup.js#L473-L509","documentation":"Accounts.validateNewUser throws registration-disabled-authentication-services when a new user is being created by a non-password auth service (OAuth/SAML/CAS), Accounts_Registration_AuthenticationServices_Enabled is false, and LDAP_Enable is false. It blocks automatic account provisioning on first SSO sign-in when admins have closed registration for authentication services.","triggerScenarios":"First login via GitHub/Google/SAML/custom OAuth on a workspace where Accounts_Registration_AuthenticationServices_Enabled is false: the login handler tries to create the user and validateNewUser rejects it because user.services has no password entry.","commonSituations":"Admins disable 'Registration with authentication services' intending only to stop public password signup and unknowingly break SSO onboarding; a user tries SSO before any password account exists for them.","solutions":["Enable Accounts_Registration_AuthenticationServices_Enabled (Administration -> Accounts -> Registration)","Or have the user register with email/password first, then connect the auth service to the same account","If users come from LDAP, enable LDAP so the LDAP branch of the check passes","Pre-create/invite users via admin APIs instead of relying on SSO auto-registration"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const ssoRegistrationAllowed =\n  settings.get('Accounts_Registration_AuthenticationServices_Enabled') === true ||\n  settings.get('LDAP_Enable') === true;\n// surface a configuration warning to admins before wiring SSO when false","typeGuard":null,"tryCatchPattern":"try {\n  await loginWithService(...);\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'registration-disabled-authentication-services') {\n    // first-time SSO provisioning blocked: instruct admin to enable the setting or pre-create the account\n  }\n  throw e;\n}","preventionTips":["When disabling public registration, review Accounts_Registration_AuthenticationServices_Enabled explicitly","Pre-create/invite SSO users instead of relying on auto-provisioning","Document for helpdesk: this error means no password service exists on the user and registration is closed"],"tags":["authentication","registration","sso","oauth","saml"],"backgroundTag":"self-registration-disabled","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}