{"record":{"id":"162c2339c8b6c986","repo":"nats-io/nats-server","slug":"operator-mode-does-not-allow-specifying-users-in-l","errorCode":null,"errorMessage":"operator mode does not allow specifying users in leafnode config","messagePattern":"operator mode does not allow specifying users in leafnode config","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":271,"sourceCode":"\t\tif err := checkAccountExists(o.LeafNode.Account, \"authorization\"); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tfor _, lu := range o.LeafNode.Users {\n\t\t\tif lu.Account == nil { // means global account\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif err := checkAccountExists(lu.Account.Name, \"authorization\"); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t\tfor _, r := range o.LeafNode.Remotes {\n\t\t\tif err := checkAccountExists(r.LocalAccount, \"remote\"); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t} else {\n\t\tif len(o.LeafNode.Users) != 0 {\n\t\t\treturn fmt.Errorf(\"operator mode does not allow specifying users in leafnode config\")\n\t\t}\n\t\tfor _, r := range o.LeafNode.Remotes {\n\t\t\tif !nkeys.IsValidPublicAccountKey(r.LocalAccount) {\n\t\t\t\treturn fmt.Errorf(\n\t\t\t\t\t\"operator mode requires account nkeys in remotes. \" +\n\t\t\t\t\t\t\"Please add an `account` key to each remote in your `leafnodes` section, to assign it to an account. \" +\n\t\t\t\t\t\t\"Each account value should be a 56 character public key, starting with the letter 'A'\")\n\t\t\t}\n\t\t}\n\t\tif o.LeafNode.Port != 0 && o.LeafNode.Account != \"\" && !nkeys.IsValidPublicAccountKey(o.LeafNode.Account) {\n\t\t\treturn fmt.Errorf(\"operator mode and non account nkeys are incompatible\")\n\t\t}\n\t}\n\n\t// Validate compression settings\n\tif o.LeafNode.Compression.Mode != _EMPTY_ {\n\t\tif err := validateAndNormalizeCompressionOption(&o.LeafNode.Compression, CompressionS2Auto); err != nil {\n\t\t\treturn err","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L253-L289","documentation":"Leafnode validation in operator mode: explicit users in the leafnodes authorization section are forbidden because in operator mode credentials/identities are governed by operator-signed JWTs, not static config users.","triggerScenarios":"Thrown at server/leafnode.go:271 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the users block from leafnodes config","Rely on operator-signed credentials for leafnode auth","Switch to non-operator mode if static users are required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}