{"record":{"id":"16e434c63c56cac0","repo":"RocketChat/Rocket.Chat","slug":"edit-federated-user-not-allowed","errorCode":"Edit_Federated_User_Not_Allowed","errorMessage":"Not possible to edit a federated user","messagePattern":"Not possible to edit a federated user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/users/saveUser/saveUser.ts","lineNumber":80,"sourceCode":"\tauditStore?: UserChangedAuditStore;\n};\n\nconst findUserById = async (uid: IUser['_id']): Promise<IUser> => {\n\tconst user = await Users.findOneById(uid);\n\tif (!user) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user');\n\t}\n\n\treturn user;\n};\n\nconst _saveUser = (session?: ClientSession) =>\n\tasync function (userId: IUser['_id'], userData: SaveUserData, options?: SaveUserOptions) {\n\t\tconst performedBy = await findUserById(userId);\n\n\t\tconst oldUserData = userData._id && (await Users.findOneById(userData._id));\n\t\tif (oldUserData && isUserFederated(oldUserData)) {\n\t\t\tthrow new Meteor.Error('Edit_Federated_User_Not_Allowed', 'Not possible to edit a federated user');\n\t\t}\n\n\t\tawait validateUserData(userId, userData);\n\n\t\tawait callbacks.run('beforeSaveUser', {\n\t\t\tuser: userData,\n\t\t\toldUser: oldUserData,\n\t\t});\n\n\t\tlet sendPassword = false;\n\n\t\tif (userData.hasOwnProperty('setRandomPassword')) {\n\t\t\tif (userData.setRandomPassword) {\n\t\t\t\tuserData.password = generatePassword();\n\t\t\t\tuserData.requirePasswordChange = true;\n\t\t\t\tsendPassword = true;\n\t\t\t}\n","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/users/saveUser/saveUser.ts#L62-L98","documentation":"saveUser throws Edit_Federated_User_Not_Allowed when the user being modified (oldUserData found by userData._id) has the federated flag set. Federated users' identity is owned by their home server, so the local server refuses to edit them through saveUser.","triggerScenarios":"Admin console or REST call that updates a federated user's profile fields; user-import or sync jobs that iterate all users including federated ones.","commonSituations":"Federation enabled for external collaboration and admins later trying to 'clean up' remote-participating accounts; sync connectors not filtering on the federated flag.","solutions":["Edit the user on their home (origin) server instead; the change federates back","Filter federated users out of bulk edit/sync jobs (check isUserFederated(user) before calling saveUser)","If the account must be neutralized locally, deactivate it rather than edit it"],"exampleFix":"// before\nawait saveUser(actorId, { _id: targetId, name: 'New Name' }); // federated -> error\n\n// after\nconst target = await Users.findOneById(targetId, { projections: { federated: 1 } });\nif (isUserFederated(target)) {\n  throw new Error('Edit this user on its home server');\n}\nawait saveUser(actorId, { _id: targetId, name: 'New Name' });","handlingStrategy":"validation","validationCode":"const target = await Users.findOneById(userData._id, { projections: { federated: 1 } });\nif (target && isUserFederated(target)) {\n  throw new Error('Edit federated users on their home server');\n}\nawait saveUser(actorId, userData);","typeGuard":"const isFederatedTarget = (u: IUser | null): boolean => !!u && isUserFederated(u);","tryCatchPattern":"try {\n  await saveUser(actorId, userData);\n} catch (e) {\n  if (isMeteorErrorCode(e, 'Edit_Federated_User_Not_Allowed')) {\n  \t// route the edit to the user's home server instead\n  }\n}","preventionTips":["Filter federated users out of directory-sync and bulk-edit jobs","Surface an 'external account' badge in admin UIs so admins do not attempt local edits"],"tags":["users","federation","editing","permissions"],"backgroundTag":"federated-user-restricted","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}