{"record":{"id":"6f1358f0b4dae59f","repo":"RocketChat/Rocket.Chat","slug":"error-not-authorized-federation","errorCode":"error-not-authorized-federation","errorMessage":"Not authorized to access federation","messagePattern":"Not authorized to access federation","errorType":"error_code","errorClass":"MeteorError","httpStatus":null,"severity":"error","filePath":"apps/meteor/ee/server/hooks/federation/index.ts","lineNumber":145,"sourceCode":"\t\tif (subscription) {\n\t\t\tif (!isBannedSubscription(subscription)) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// For federated rooms, unban requires a Matrix kick (leave) followed by a new invite.\n\t\t\t// Remove the subscription so the unban propagates to Matrix via the afterUnbanFromRoom callback,\n\t\t\t// then let the flow continue to create a new INVITED subscription via the beforeAddUserToRoom hook.\n\t\t\tawait Subscriptions.removeById(subscription._id);\n\n\t\t\tawait Message.saveSystemMessage('user-unbanned', room._id, user.username, inviter);\n\n\t\t\tvoid notifyOnSubscriptionChanged(subscription, 'removed');\n\t\t\tvoid notifyOnRoomChangedById(room._id);\n\n\t\t\tawait afterUnbanFromRoomCallback.run({ unbannedUser: user, userWhoUnbanned: inviter }, room);\n\t\t}\n\n\t\tif (!isUserNativeFederated(user) && !(await FederationMatrix.canUserAccessFederation(user))) {\n\t\t\tthrow new MeteorError('error-not-authorized-federation', 'Not authorized to access federation');\n\t\t}\n\n\t\t// If inviter is federated, the invite came from an external transaction.\n\t\t// Don't propagate back to Matrix (it was already processed at origin server).\n\t\tif (isUserNativeFederated(inviter)) {\n\t\t\treturn;\n\t\t}\n\n\t\tawait FederationMatrix.inviteUsersToRoom(room, [user.username], inviter);\n\n\t\t// after invite is sent we create the invite subscriptions\n\t\t// TODO this may be not needed if we receive the emit for the invite event from matrix\n\t\tawait Room.createUserSubscription({\n\t\t\tts: new Date(),\n\t\t\troom,\n\t\t\tuserToBeAdded: user,\n\t\t\tinviter,\n\t\t\tstatus: 'INVITED',","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/ee/server/hooks/federation/index.ts#L127-L163","documentation":"Thrown by the `beforeAddUserToRoom` federation hook when the invitee is not a native-federated user AND `FederationMatrix.canUserAccessFederation(user)` returns false. Access is denied if the user lacks the `access-federation` permission, or (when domain validation is enabled) has no verified email matching the server's domain. It is a `MeteorError` with code `error-not-authorized-federation`.","triggerScenarios":"Inviting a local (non-native-federated) user into a federated room when the user is missing the `access-federation` permission, or `validateUserDomain` is enabled and none of the user's verified emails match the server name.","commonSituations":"Permission `access-federation` was revoked from the user's role; federation domain restriction enabled but user's email domain doesn't match; new SSO/LDAP user without federation permission assigned.","solutions":["Grant the `access-federation` permission to the user (or their role).","If domain validation is enabled, ensure the user has a verified email at the server's domain.","Review the `validateUserDomain` federation setting and the user's verified email list."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import { Authorization } from '../../../../server/authorization';\n\nasync function userCanAccessFederation(user: IUser): Promise<boolean> {\n\treturn Authorization.hasPermission({ _id: user._id, roles: user.roles }, 'access-federation');\n}","typeGuard":"function isNotAuthorizedFederationError(e: unknown): boolean {\n\treturn e instanceof Meteor.Error && (e as Meteor.Error).error === 'error-not-authorized-federation';\n}","tryCatchPattern":"try {\n\tawait beforeAddUserToRoom.run({ user, inviter }, room);\n} catch (e) {\n\tif (e instanceof Meteor.Error && e.error === 'error-not-authorized-federation') {\n\t\t// grant access-federation permission or fix domain validation\n\t}\n\tthrow e;\n}","preventionTips":["Grant `access-federation` permission to users/roles that need federation.","If domain validation is on, ensure users have a verified email at the server domain.","Audit federation permissions during onboarding/role changes."],"tags":["federation","permissions","auth","ee","meteor-error"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}