{"record":{"id":"8bb30458a02e3531","repo":"RocketChat/Rocket.Chat","slug":"error-user-is-federated","errorCode":"error-user-is-federated","errorMessage":"Cannot change federated users status","messagePattern":"Cannot change federated users status","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/users/setUserActiveStatus.ts","lineNumber":68,"sourceCode":"}\n\nexport async function setUserActiveStatus(\n\tuserId: string,\n\tactive: boolean,\n\tconfirmRelinquish = false,\n\texecutedBy?: string,\n): Promise<boolean | undefined> {\n\tcheck(userId, String);\n\tcheck(active, Boolean);\n\n\tconst user = await Users.findOneById(userId);\n\n\tif (!user) {\n\t\treturn false;\n\t}\n\n\tif (isUserFederated(user)) {\n\t\tthrow new Meteor.Error('error-user-is-federated', 'Cannot change federated users status', {\n\t\t\tmethod: 'setUserActiveStatus',\n\t\t});\n\t}\n\n\t// Users without username can't do anything, so there is no need to check for owned rooms\n\tif (user.username != null && !active) {\n\t\tconst userAdmin = await Users.findOneAdmin(userId || '');\n\t\tconst adminsCount = await Users.countActiveUsersInRoles(['admin']);\n\t\tif (userAdmin && adminsCount === 1) {\n\t\t\tthrow new Meteor.Error('error-action-not-allowed', 'Leaving the app without an active admin is not allowed', {\n\t\t\t\tmethod: 'removeUserFromRole',\n\t\t\t\taction: 'Remove_last_admin',\n\t\t\t});\n\t\t}\n\n\t\tconst subscribedRooms = await getSubscribedRoomsForUserWithDetails(userId);\n\t\t// give omnichannel rooms a special treatment :)\n\t\tconst chatSubscribedRooms = subscribedRooms.filter(({ t }) => t !== 'l');","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/users/setUserActiveStatus.ts#L50-L86","documentation":"setUserActiveStatus refuses to change the active status of federated users: isUserFederated(user) is true when the user document has federated === true (accounts homed on another server in a Rocket.Chat federation). The lifecycle of such users is controlled by their home server, so local activation/deactivation is blocked.","triggerScenarios":"Calling setUserActiveStatus (the users.deactivate / users.activate endpoints route here) for a user whose document has federated: true — i.e., a colleague from another federated server appearing in your user directory.","commonSituations":"Admin tries to deactivate a federated user from the local admin console; bulk user-management/offboarding scripts iterate all users without filtering out federated ones; federation was enabled and the directory now mixes local and federated accounts.","solutions":["Manage the user's active status on their home server in the federation.","Filter federated users (federated === true) out of bulk deactivation/activation scripts.","If this user should be local, review your federation setup and the user's origin before attempting local changes."],"exampleFix":"// before\nfor (const uid of allUserIds) {\n  await setUserActiveStatus(uid, false); // throws on federated users\n}\n\n// after\nfor (const uid of allUserIds) {\n  const user = await Users.findOneById(uid);\n  if (user?.federated === true) continue; // skip federated users\n  await setUserActiveStatus(uid, false);\n}","handlingStrategy":"validation","validationCode":"const user = await Users.findOneById(userId, { projection: { federated: 1 } });\nif (user && 'federated' in user && user.federated === true) {\n  throw new Meteor.Error('error-user-is-federated', 'Cannot change federated users status');\n}\nawait setUserActiveStatus(userId, active, confirmRelinquish);","typeGuard":"import type { IUser } from '@rocket.chat/core-typings';\n\nconst isFederatedUser = (user: Partial<IUser>): boolean =>\n  'federated' in user && (user as { federated?: boolean }).federated === true;","tryCatchPattern":null,"preventionTips":["Filter federated users (federated === true) out of all bulk user-management operations.","Hide deactivate/activate actions in admin UIs for federated users.","Remember federated users must be managed on their home server, never locally."],"tags":["federation","user-management","permissions"],"backgroundTag":"federated-user-restriction","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}