{"record":{"id":"a68b33617f1db8bc","repo":"RocketChat/Rocket.Chat","slug":"max-users-allowed-reached-creating-new-ldap-users","errorCode":null,"errorMessage":"Max users allowed reached, creating new LDAP users in inactive state ","messagePattern":"Max users allowed reached, creating new LDAP users in inactive state ","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"apps/meteor/server/lib/ldap/UserConverter.ts","lineNumber":54,"sourceCode":"\n\t\tif (data.emails.length) {\n\t\t\tconst emailUser = await Users.findOneWithoutLDAPByEmailAddress(data.emails[0], {});\n\n\t\t\tif (emailUser) {\n\t\t\t\treturn emailUser;\n\t\t\t}\n\t\t}\n\n\t\tif (data.username) {\n\t\t\treturn Users.findOneWithoutLDAPByUsernameIgnoringCase<IUser>(data.username);\n\t\t}\n\t}\n\n\toverride async insertUser(userData: IImportUser): Promise<IUser['_id']> {\n\t\tif (!userData.deleted) {\n\t\t\t// #TODO: Change the LDAP sync process to split the inserts and updates into two stages so that we can validate this only once for all insertions\n\t\t\tif (await License.shouldPreventAction('activeUsers')) {\n\t\t\t\tlogger.warn({ msg: 'Max users allowed reached, creating new LDAP users in inactive state ', username: userData.username });\n\t\t\t\tuserData.deleted = true;\n\t\t\t}\n\t\t}\n\n\t\treturn super.insertUser(userData);\n\t}\n\n\tstatic async convertSingleUser(userData: IImportUser, options?: UserConverterOptions): Promise<void> {\n\t\tconst converter = new LDAPUserConverter(options);\n\t\tawait converter.addObject(userData);\n\t\tawait converter.convertData();\n\t}\n}\n","sourceCodeStart":36,"sourceCodeEnd":68,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/ldap/UserConverter.ts#L36-L68","documentation":"The workspace license's active-user cap has been reached: License.shouldPreventAction('activeUsers') returned true while the LDAP user converter was inserting new users. Instead of blocking the sync, new LDAP users are created in an inactive state (userData.deleted = true) to stay within the license. Existing users are untouched; only newly synced users come in deactivated.","triggerScenarios":"An LDAP login or LDAP_DataSync run inserts new users when the workspace already has as many active users as the license allows — e.g. onboarding new employees via LDAP after seats ran out.","commonSituations":"Company grows past the licensed seat count between license renewals; LDAP sync filter broader than expected imports service accounts or contractors; test workspaces with small trial licenses syncing a whole directory.","solutions":["Deactivate users that no longer need access (Administration > Users) to free active seats","Apply a license with a higher active-user limit (upgrade/renew)","Tighten LDAP_User_Search_Filter / sync scope so only intended users are imported","After seats are freed, re-run the LDAP sync (or manually activate the users) so previously synced inactive users become active"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import { License } from '@rocket.chat/license';\n\nif (await License.shouldPreventAction('activeUsers')) {\n  // alert admins BEFORE running sync: seats exhausted, new LDAP users will be created inactive\n  Notifications.notifyAdmins({ msg: 'License active-user limit reached; LDAP sync will deactivate new users' });\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Monitor active-user count against the license limit and alert before it is reached","Scope LDAP_User_Search_Filter so only needed users are imported","After raising seats, re-run the sync to activate users that came in inactive"],"tags":["ldap","license","user-management","sync"],"backgroundTag":"license-user-limit-reached","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}