{"record":{"id":"4b5a73e5c93cae06","repo":"nats-io/nats-server","slug":"no-auth-user-not-compatible-with-trusted-operator","errorCode":null,"errorMessage":"no_auth_user not compatible with Trusted Operator","messagePattern":"no_auth_user not compatible with Trusted Operator","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":1776,"sourceCode":"\t\t\tjwt.ConnectionTypeMqtt, jwt.ConnectionTypeMqttWS,\n\t\t\tjwt.ConnectionTypeInProcess:\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unknown connection type %q\", ct)\n\t\t}\n\t\tif ctuc != ct {\n\t\t\tdelete(m, ct)\n\t\t\tm[ctuc] = struct{}{}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateNoAuthUser(o *Options, noAuthUser string) error {\n\tif noAuthUser == _EMPTY_ {\n\t\treturn nil\n\t}\n\tif len(o.TrustedOperators) > 0 {\n\t\treturn fmt.Errorf(\"no_auth_user not compatible with Trusted Operator\")\n\t}\n\n\tif o.Nkeys == nil && o.Users == nil {\n\t\treturn fmt.Errorf(`no_auth_user: \"%s\" present, but users/nkeys are not defined`, noAuthUser)\n\t}\n\tfor _, u := range o.Users {\n\t\tif u.Username == noAuthUser {\n\t\t\treturn nil\n\t\t}\n\t}\n\tfor _, u := range o.Nkeys {\n\t\tif u.Nkey == noAuthUser {\n\t\t\treturn nil\n\t\t}\n\t}\n\treturn fmt.Errorf(\n\t\t`no_auth_user: \"%s\" not present as user or nkey in authorization block or account configuration`,\n\t\tnoAuthUser)","sourceCodeStart":1758,"sourceCodeEnd":1794,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L1758-L1794","documentation":"The no_auth_user option is incompatible with trusted operator mode. When operators (TrustedOperators) are configured, authentication is fully governed by operator/account JWTs and the implicit anonymous-user shortcut of no_auth_user cannot be honored, so the server refuses the combination.","triggerScenarios":"Starting or validating a server with both `no_auth_user` set in options and one or more TrustedOperators present (validateNoAuthUser). This happens via config file, command line flag, or Options struct assembled in code.","commonSituations":"Operators migrating an existing open-auth setup to operator-based security who kept no_auth_user in the config; merged config files where an operator block was added while no_auth_user remained.","solutions":["Remove no_auth_user from the configuration when using a trusted operator.","Define the desired anonymous access as a proper user/nkey in an account with limited permissions instead.","If operator mode is not intended, remove the operator/resolver configuration instead.","Reload the server after cleaning the config: `nats-server --signal reload`."],"exampleFix":"// before (config)\noperator: $OPS\nresolver: MEMORY\nno_auth_user: guest\n// after\noperator: $OPS\nresolver: MEMORY\n# no_auth_user removed; anonymous handled by account-scoped user","handlingStrategy":"validation","validationCode":"if opts.NoAuthUser != \"\" && len(opts.TrustedOperators) > 0 {\n    return errors.New(\"no_auth_user cannot be used with trusted operators\")\n}","typeGuard":null,"tryCatchPattern":"if err := validateOptions(opts); err != nil {\n    if strings.Contains(err.Error(), \"no_auth_user not compatible\") {\n        log.Fatal(\"remove no_auth_user from operator-mode config\")\n    }\n}","preventionTips":["Audit config templates when migrating to operator mode","Search configs for no_auth_user before adding operator blocks","Encode this incompatibility in config generation tooling"],"tags":["config","operator","authentication","nats"],"backgroundTag":"incompatible-auth-options","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}