{"record":{"id":"34e2cb821097f68b","repo":"n8n-io/n8n","slug":"ssoidentity-providertype-touppercase-user-may","errorCode":null,"errorMessage":"${ssoIdentity.providerType.toUpperCase()} user may not change their profile information","messagePattern":"(.+?) user may not change their profile information","errorType":"exception","errorClass":"BadRequestError","httpStatus":400,"severity":"warning","filePath":"packages/cli/src/controllers/me.controller.ts","lineNumber":84,"sourceCode":"\t\tconst { currentPassword, ...payloadWithoutPassword } = payload;\n\t\tconst { email, firstName, lastName } = payload;\n\t\tconst isEmailBeingChanged = email !== currentEmail;\n\t\tconst isFirstNameChanged = firstName !== currentFirstName;\n\t\tconst isLastNameChanged = lastName !== currentLastName;\n\n\t\t// Check if the user is authenticated via SSO - they cannot change their profile info\n\t\tif (isEmailBeingChanged || isFirstNameChanged || isLastNameChanged) {\n\t\t\tconst ssoIdentity = await this.userService.findSsoIdentity(userId);\n\n\t\t\tif (ssoIdentity && this.isAuthIdentityActive(ssoIdentity)) {\n\t\t\t\tthis.logger.debug(\n\t\t\t\t\t`Request to update user failed because ${ssoIdentity.providerType} user may not change their profile information`,\n\t\t\t\t\t{\n\t\t\t\t\t\tuserId,\n\t\t\t\t\t\tpayload: payloadWithoutPassword,\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t\tthrow new BadRequestError(\n\t\t\t\t\t`${ssoIdentity.providerType.toUpperCase()} user may not change their profile information`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tawait this.validateChangingUserEmail(req.user, payload);\n\n\t\tawait this.externalHooks.run('user.profile.beforeUpdate', [\n\t\t\tuserId,\n\t\t\tcurrentEmail,\n\t\t\tpayloadWithoutPassword,\n\t\t]);\n\n\t\tconst preUpdateUser = await this.userRepository.findOneByOrFail({ id: userId });\n\t\tawait this.userService.update(userId, payloadWithoutPassword);\n\t\tconst user = await this.userService.findUserWithAuthIdentities(userId);\n\n\t\tthis.logger.info('User updated successfully', { userId });","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/me.controller.ts#L66-L102","documentation":"A BadRequestError (HTTP 400) from updateProfile when the user is attempting to change email/firstName/lastName and userService.findSsoIdentity(userId) returns an active SSO auth identity. SSO-authenticated users (SAML/LDAP) have their profile attributes managed by the IdP, so profile changes via the API are rejected. The provider type is uppercased into the message.","triggerScenarios":"PATCH /me with a changed email, firstName, or lastName where the user has an active SSO auth identity (e.g. signed in via SAML). The check runs only when at least one of those three fields is being changed.","commonSituations":"A SAML/LDAP user tries to rename themselves in the UI; an IdP rename has not propagated and the user attempts a manual override; mixed-mode instance where a user has both a password and an SSO identity.","solutions":["Update the user's profile attributes in the Identity Provider (SAML/LDAP directory) instead of the n8n API.","Wait for the next SSO login to sync the corrected attributes into n8n.","If the SSO identity is stale/inactive, an admin can deactivate it so the user may self-edit again."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// If the user has an active SSO identity, block profile edits client-side.\nconst identities = await api.get(`/users/${me.id}/sso-identities`);\nconst hasActiveSso = identities.some((i) => i.status === 'active');\nif (hasActiveSso && profileFieldsChanged(payload, me)) {\n  throw new Error('Profile is managed by your Identity Provider.');\n}","typeGuard":"function hasActiveSsoIdentity(ids: Array<{ status: string }>): boolean {\n  return ids.some((i) => i.status === 'active');\n}","tryCatchPattern":"try {\n  await api.patch('/me', payload);\n} catch (e) {\n  if (e.response?.status === 400 && /may not change their profile/i.test(e.response.data.message)) {\n    notify('Update your profile in your Identity Provider.');\n    return;\n  }\n  throw e;\n}","preventionTips":["Hide profile-edit fields for users with an active SSO identity.","Coordinate profile changes through the IdP, not the n8n API.","Admins can deactivate a stale SSO identity to restore self-edit."],"tags":["me","profile","sso","saml","rest-api"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}