{"record":{"id":"ac31c492355576eb","repo":"RocketChat/Rocket.Chat","slug":"error-not-authorized","errorCode":"error-not-authorized","errorMessage":"error-not-authorized","messagePattern":"error-not-authorized","errorType":"http","errorClass":"Error","httpStatus":403,"severity":"error","filePath":"apps/meteor/ee/server/api/ldap.ts","lineNumber":36,"sourceCode":"API.v1.post(\n\t'ldap.syncNow',\n\t{\n\t\tauthRequired: true,\n\t\tforceTwoFactorAuthenticationForNonEnterprise: true,\n\t\ttwoFactorRequired: true,\n\t\tresponse: {\n\t\t\t200: ldapSyncNowResponseSchema,\n\t\t\t400: validateBadRequestErrorResponse,\n\t\t\t401: validateUnauthorizedErrorResponse,\n\t\t},\n\t},\n\tasync function action() {\n\t\tif (!this.userId) {\n\t\t\tthrow new Error('error-invalid-user');\n\t\t}\n\n\t\tif (!(await hasPermissionAsync(this.user, 'sync-auth-services-users'))) {\n\t\t\tthrow new Error('error-not-authorized');\n\t\t}\n\n\t\tif (settings.get('LDAP_Enable') !== true) {\n\t\t\tthrow new Error('LDAP_disabled');\n\t\t}\n\n\t\tawait LDAPEnterprise.sync();\n\t\tawait LDAPEnterprise.syncAvatarAndAbacAttributes();\n\n\t\treturn API.v1.success({\n\t\t\tmessage: 'Sync_in_progress' as const,\n\t\t});\n\t},\n);\n","sourceCodeStart":18,"sourceCodeEnd":51,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/ee/server/api/ldap.ts#L18-L51","documentation":"Thrown by POST ldap.syncNow when the authenticated user lacks the 'sync-auth-services-users' permission. Rocket.Chat gates LDAP sync operations behind this permission to restrict who can trigger a directory-wide sync. The throw is a plain Error with code 'error-not-authorized' and occurs after the user-id check passes.","triggerScenarios":"An authenticated admin or regular user calls POST /v1/ldap.syncNow but their roles do not include a role granted 'sync-auth-services-users'. Common when a non-super-admin tries the sync, or after permissions were restructured and the role lost the grant.","commonSituations":"Custom role used for admin tasks but missing the sync permission; permissions reset during an upgrade; user authenticated but with read-only admin scope.","solutions":["Grant 'sync-auth-services-users' to the calling user's role (Administration > Permissions).","Re-authenticate as a user that already holds the permission (e.g. the main admin account).","Verify the permission grant was not removed by a permissions import/migration.","Use an API token scoped to an authorized admin user."],"exampleFix":"// before: calling with a role lacking the permission\nPOST /v1/ldap.syncNow  (user role: 'livechat-manager')\n\n// after: grant the permission to that role, or call with an admin token\nPOST /v1/ldap.syncNow  (X-Auth-Token of a user with 'sync-auth-services-users')","handlingStrategy":"validation","validationCode":"// Verify the caller holds the permission before calling\nasync function canSyncLdap(user: { _id: string }): Promise<boolean> {\n  // GET /v1/roles.list + GET /v1/permissions, or use server-side hasPermission\n  return await serverHasPermission(user._id, 'sync-auth-services-users');\n}\nif (!(await canSyncLdap(currentUser))) {\n  throw new Error('missing sync-auth-services-users permission');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await api.post('ldap.syncNow', {});\n} catch (e) {\n  if (e.message === 'error-not-authorized') {\n    notifyInsufficientPermission('sync-auth-services-users');\n    return;\n  }\n  throw e;\n}","preventionTips":["Restrict ldap.syncNow calls to users whose roles carry sync-auth-services-users.","Surface a clear permission-missing message in the admin UI rather than a raw error."],"tags":["authorization","ldap","rest-api","permissions"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}