{"record":{"id":"6249f8d67661398e","repo":"RocketChat/Rocket.Chat","slug":"we-should-have-at-least-one-existing-role-to-creat","errorCode":null,"errorMessage":"We should have at least one existing role to create the user: ${normalizedRoleNamesOrIds.join(', ')}","messagePattern":"We should have at least one existing role to create the user: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/saml/lib/SAML.ts","lineNumber":49,"sourceCode":"};\n\nconst convertRoleNamesToIds = async (roleNamesOrIds: string[]): Promise<IRole['_id'][]> => {\n\tconst normalizedRoleNamesOrIds = roleNamesOrIds.map((role) => role.trim()).filter((role) => role.length > 0);\n\tif (!normalizedRoleNamesOrIds.length) {\n\t\tthrow new Error(`No valid role names or ids provided for conversion: ${roleNamesOrIds.join(', ')}`);\n\t}\n\n\tconst roles = (await Roles.findInIdsOrNames(normalizedRoleNamesOrIds).toArray()).map((role) => role._id);\n\n\tif (roles.length !== normalizedRoleNamesOrIds.length) {\n\t\tSystemLogger.warn({\n\t\t\tmsg: 'Failed to convert some role names to ids',\n\t\t\troles: normalizedRoleNamesOrIds,\n\t\t});\n\t}\n\n\tif (!roles.length) {\n\t\tthrow new Error(`We should have at least one existing role to create the user: ${normalizedRoleNamesOrIds.join(', ')}`);\n\t}\n\n\treturn roles;\n};\n\nexport class SAML {\n\tpublic static async processRequest(\n\t\treq: IIncomingMessage,\n\t\tres: ServerResponse,\n\t\tservice: IServiceProviderOptions,\n\t\tsamlObject: ISAMLAction,\n\t): Promise<void> {\n\t\t// Skip everything if there's no service set by the saml middleware\n\t\tif (!service) {\n\t\t\tif (samlObject.actionName === 'metadata') {\n\t\t\t\tshowErrorMessage(res, `Unexpected SAML service ${samlObject.serviceName}`);\n\t\t\t\treturn;\n\t\t\t}","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/2a7de457074cbb4d4373fbd9a4e5bea292c9c764/apps/meteor/server/lib/saml/lib/SAML.ts#L31-L67","documentation":"Error \"We should have at least one existing role to create the user: ${normalizedRoleNamesOrIds.join(', ')}\" thrown in RocketChat/Rocket.Chat.","triggerScenarios":"Thrown during SAML user provisioning when none of the mapped roles exist in the server, so the new user would have no role.","commonSituations":"See trigger scenarios.","solutions":["Ensure at least one of the mapped SAML roles already exists on the server; create the role or fix the role mapping configuration."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2a7de457074cbb4d4373fbd9a4e5bea292c9c764","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}