{"record":{"id":"1484244d7b01f044","repo":"apolloconfig/apollo","slug":"create-or-update-user-operation-is-unsupported-148424","errorCode":null,"errorMessage":"Create or update user operation is unsupported","messagePattern":"Create or update user operation is unsupported","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":500,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java","lineNumber":78,"sourceCode":"    this.userInfoHolder = userInfoHolder;\n    this.logoutHandler = logoutHandler;\n    this.userService = userService;\n    this.passwordChecker = passwordChecker;\n    this.unifiedPermissionValidator = unifiedPermissionValidator;\n  }\n\n  @PostMapping(\"/users\")\n  public void createOrUpdateUser(\n      @RequestParam(value = \"isCreate\", defaultValue = \"false\") boolean isCreate,\n      @RequestBody UserPO user) {\n    if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {\n      throw new BadRequestException(\"Username and password can not be empty.\");\n    }\n\n    if (!unifiedPermissionValidator.isSuperAdmin()\n        && (!user.getUsername().equals(userInfoHolder.getUser().getUserId())\n            || user.getEnabled() != USER_ENABLED)) {\n      throw new UnsupportedOperationException(\"Create or update user operation is unsupported\");\n    }\n\n    CheckResult pwdCheckRes = passwordChecker.checkWeakPassword(user.getPassword());\n    if (!pwdCheckRes.isSuccess()) {\n      throw new BadRequestException(pwdCheckRes.getMessage());\n    }\n\n    if (userService instanceof SpringSecurityUserService) {\n      if (isCreate) {\n        ((SpringSecurityUserService) userService).create(user);\n      } else {\n        ((SpringSecurityUserService) userService).update(user);\n      }\n    } else {\n      throw new UnsupportedOperationException(\"Create or update user operation is unsupported\");\n    }\n  }\n","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java#L60-L96","documentation":"Thrown by UserInfoController.createOrUpdateUser when the caller is NOT a super-admin AND either the target username differs from the logged-in user, or the request tries to set enabled != 1. It is an UnsupportedOperationException (authorization guard) — typically HTTP 500/403 depending on handler. Only super-admins may create users or change another user's record; a non-admin may only edit their own account while keeping enabled=1.","triggerScenarios":"A non-super-admin POST /users whose username != their own userId, or whose enabled != USER_ENABLED(1). Also when a regular user attempts to disable/enable themselves or set enabled=0.","commonSituations":"A team-admin role (not super-admin) tries to provision a teammate; a user tries to self-disable; permission validator mis-configured so an intended admin lacks the super-admin flag.","solutions":["Perform user creation/management as a user holding the super-admin role (apollo portal superAdmins config).","If editing your own account, ensure username equals your own userId and enabled stays 1.","Grant the acting user super-admin via portal's superAdmin list (portal DB / config) if they should manage users.","Use the dedicated PUT /users/enabled endpoint (super-admin only) to toggle enabled state."],"exampleFix":"// before: non-admin tries to create another user\nuser.setUsername(\"bob\"); user.setEnabled(1); postUsers(user, true);\n\n// after: only super-admin may do this; check role client-side\nif (!permissionValidator.isSuperAdmin()) {\n  throw new AccessDeniedException(\"only super-admin can create users\");\n}\npostUsers(user, true);","handlingStrategy":"validation","validationCode":"boolean selfEditOk = user.getUsername().equals(currentUserId) && user.getEnabled() == 1;\nif (!isSuperAdmin && !selfEditOk) {\n  return ResponseEntity.status(HttpStatus.FORBIDDEN).body(\"only super-admin may manage other users\");\n}","typeGuard":"boolean canManageUser(UserPO target, String currentUserId, boolean isSuperAdmin) {\n  return isSuperAdmin || (target.getUsername().equals(currentUserId) && target.getEnabled() == 1);\n}","tryCatchPattern":null,"preventionTips":["Reserve user management for super-admin accounts.","Non-admins may only edit their own account with enabled=1.","Use PUT /users/enabled for enable/disable (super-admin only)."],"tags":["apollo-portal","authorization","user-management","permissions"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}