{"record":{"id":"6bb44458c4c164e6","repo":"theonedev/onedev","slug":"cannot-set-password-for-disabled-account","errorCode":null,"errorMessage":"Cannot set password for disabled account","messagePattern":"Cannot set password for disabled account","errorType":"http","errorClass":"ExplicitException","httpStatus":400,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java","lineNumber":489,"sourceCode":"\t\tif (!SecurityUtils.isAdministrator()) \n\t\t\tthrow new UnauthorizedException();\n\t\tif (userId <= User.ROOT_ID)\t\t\n\t\t\tthrow new BadRequestException(\"Should only convert normal users to service accounts\");\n\t\tvar user = userService.load(userId);\n\t\tuserService.convertToServiceAccount(user);\n\n\t\tauditService.audit(null, \"converted user \\\"\" + user.getName() + \"\\\" to service account via RESTful API\", null, null);\n\n\t\treturn Response.ok().build();\n    }\n\t\n\t@Api(order=2000)\n\t@Path(\"/{userId}/password\")\n    @POST\n    public Response setPassword(@PathParam(\"userId\") Long userId, @Password(checkPolicy=true) @NotEmpty String password) {\n    \tUser user = userService.load(userId);\n\t\tif (user.isDisabled()) {\n\t\t\tthrow new ExplicitException(\"Cannot set password for disabled account\");\n\t\t} else if (user.getType() != ORDINARY) {\n\t\t\tthrow new ExplicitException(\"Cannot set password for service or AI account\");\n\t\t} if (SecurityUtils.isAdministrator()) {\n\t\t\tuser.setPassword(passwordService.encryptPassword(password));\n\t\t\tuserService.update(user, null);\n\t\t\tif (!getAuthUser().equals(user)) \n\t\t\t\tauditService.audit(null, \"changed password of account \\\"\" + user.getName() + \"\\\" via RESTful API\", null, null);\n\t\t\treturn Response.ok().build();\n\t\t} else if (user.equals(getAuthUser())) {\n\t\t\tif (user.getPassword() == null) {\n\t\t\t\tthrow new ExplicitException(\"The user is currently authenticated via external system, \"\n\t\t\t\t\t\t+ \"please change password there instead\");\n\t\t\t} else {\n\t\t\t\tuser.setPassword(passwordService.encryptPassword(password));\n\t\t\t\tuserService.update(user, null);\n\t\t\t\treturn Response.ok().build();\n\t\t\t}\t\t\t\n    \t} else {","sourceCodeStart":471,"sourceCodeEnd":507,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java#L471-L507","documentation":"The setPassword REST endpoint (POST /users/{userId}/password) refuses to set a password on a disabled account. OneDev intentionally blocks credential changes for accounts that are currently disabled, since the account cannot log in anyway and the change would be unauditable in normal use.","triggerScenarios":"Calling POST /rest/v1/users/{userId}/password for a user whose account is disabled (user.isDisabled() == true).","commonSituations":"Provisioning flows that reset passwords for all users in a batch including disabled ones; helpdesk resetting a password for a suspended account; syncing passwords for inactive users.","solutions":["Re-enable the user account first (enable in UI or POST /users/{id}/enable) then set the password","Skip disabled users in bulk password-reset scripts by filtering on the user's enabled status","Check the user's disabled state via GET /users/{userId} before attempting the password change"],"exampleFix":"// before\nawait rest.post(`/users/${id}/password`, {password}); // 400 if disabled\n// after\nconst user = await rest.get(`/users/${id}`);\nif (!user.disabled) {\n  await rest.post(`/users/${id}/password`, {password});\n}","handlingStrategy":"validation","validationCode":"const user = await rest.get(`/users/${userId}`); if (user.disabled) throw new Error('Cannot set password for a disabled account');","typeGuard":"function canSetPassword(user) { return !user.disabled && user.type === 'ORDINARY'; }","tryCatchPattern":"try { await rest.post(`/users/${id}/password`, {password}); } catch (e) { if (e.status === 400 && /disabled account/.test(e.message)) { /* re-enable first or skip */ } else throw e; }","preventionTips":["Check the user's disabled flag before password operations","Re-enable accounts before resetting credentials","Skip inactive users in bulk credential scripts"],"tags":["rest-api","password","disabled-account","onedev"],"backgroundTag":"invalid-state-transition","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}