{"record":{"id":"6de584cdfb3e20cb","repo":"nats-io/nats-server","slug":"no-auth-user-s-present-but-users-nkeys-are-no","errorCode":null,"errorMessage":"no_auth_user: \"%s\" present, but users/nkeys are not defined","messagePattern":"no_auth_user: \"(.+?)\" present, but users/nkeys are not defined","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":1780,"sourceCode":"\t\t}\n\t\tif ctuc != ct {\n\t\t\tdelete(m, ct)\n\t\t\tm[ctuc] = struct{}{}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateNoAuthUser(o *Options, noAuthUser string) error {\n\tif noAuthUser == _EMPTY_ {\n\t\treturn nil\n\t}\n\tif len(o.TrustedOperators) > 0 {\n\t\treturn fmt.Errorf(\"no_auth_user not compatible with Trusted Operator\")\n\t}\n\n\tif o.Nkeys == nil && o.Users == nil {\n\t\treturn fmt.Errorf(`no_auth_user: \"%s\" present, but users/nkeys are not defined`, noAuthUser)\n\t}\n\tfor _, u := range o.Users {\n\t\tif u.Username == noAuthUser {\n\t\t\treturn nil\n\t\t}\n\t}\n\tfor _, u := range o.Nkeys {\n\t\tif u.Nkey == noAuthUser {\n\t\t\treturn nil\n\t\t}\n\t}\n\treturn fmt.Errorf(\n\t\t`no_auth_user: \"%s\" not present as user or nkey in authorization block or account configuration`,\n\t\tnoAuthUser)\n}\n\nfunc validateProxies(o *Options) error {\n\tif o.Proxies == nil {","sourceCodeStart":1762,"sourceCodeEnd":1798,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L1762-L1798","documentation":"The no_auth_user option names a user that is not defined anywhere: neither nkeys nor users are configured at all. The option requires that the referenced identity exists in the server's authorization/users/nkeys configuration so the server can apply its permissions to anonymous connections.","triggerScenarios":"validateNoAuthUser is called with a non-empty no_auth_user while o.Nkeys == nil and o.Users == nil — i.e. no user or nkey definitions exist in the configuration to match against.","commonSituations":"Minimal config where no_auth_user was set but the users block was deleted or never defined; configs converted from open mode where all user definitions were removed; programmatic Options with only NoAuthUser set.","solutions":["Add a user definition whose username matches the no_auth_user value.","Alternatively add an nkey entry matching no_auth_user.","Remove no_auth_user if anonymous access should be fully open or governed by operators.","Validate with `nats-server -t -c config` before deploying."],"exampleFix":"// before\nno_auth_user: guest\n// after\nno_auth_user: guest\naccounts { APP { users = [ { user: guest, password: pwd } ] } }","handlingStrategy":"validation","validationCode":"if opts.NoAuthUser != \"\" && len(opts.Users) == 0 && len(opts.Nkeys) == 0 {\n    return errors.New(\"no_auth_user set but no users/nkeys defined\")\n}","typeGuard":null,"tryCatchPattern":"if err := validateOptions(opts); err != nil {\n    if strings.Contains(err.Error(), \"users/nkeys are not defined\") {\n        log.Fatal(\"define the no_auth_user identity or remove the option\")\n    }\n}","preventionTips":["Define the anonymous user in the same config section as no_auth_user","Lint configs with `nats-server -t` in CI","Avoid hand-removing users blocks without checking no_auth_user references"],"tags":["config","authentication","nats"],"backgroundTag":"no-auth-user-not-defined","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}