{"record":{"id":"af949d599f826387","repo":"theonedev/onedev","slug":"the-user-is-currently-authenticated-via-external-s","errorCode":null,"errorMessage":"The user is currently authenticated via external system, please change password there instead","messagePattern":"The user is currently authenticated via external system, please change password there instead","errorType":"http","errorClass":"ExplicitException","httpStatus":400,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java","lineNumber":500,"sourceCode":"\t\n\t@Api(order=2000)\n\t@Path(\"/{userId}/password\")\n    @POST\n    public Response setPassword(@PathParam(\"userId\") Long userId, @Password(checkPolicy=true) @NotEmpty String password) {\n    \tUser user = userService.load(userId);\n\t\tif (user.isDisabled()) {\n\t\t\tthrow new ExplicitException(\"Cannot set password for disabled account\");\n\t\t} else if (user.getType() != ORDINARY) {\n\t\t\tthrow new ExplicitException(\"Cannot set password for service or AI account\");\n\t\t} if (SecurityUtils.isAdministrator()) {\n\t\t\tuser.setPassword(passwordService.encryptPassword(password));\n\t\t\tuserService.update(user, null);\n\t\t\tif (!getAuthUser().equals(user)) \n\t\t\t\tauditService.audit(null, \"changed password of account \\\"\" + user.getName() + \"\\\" via RESTful API\", null, null);\n\t\t\treturn Response.ok().build();\n\t\t} else if (user.equals(getAuthUser())) {\n\t\t\tif (user.getPassword() == null) {\n\t\t\t\tthrow new ExplicitException(\"The user is currently authenticated via external system, \"\n\t\t\t\t\t\t+ \"please change password there instead\");\n\t\t\t} else {\n\t\t\t\tuser.setPassword(passwordService.encryptPassword(password));\n\t\t\t\tuserService.update(user, null);\n\t\t\t\treturn Response.ok().build();\n\t\t\t}\t\t\t\n    \t} else {\n\t\t\tthrow new UnauthorizedException();\n\t\t}\n    }\n\n\t@Api(order=2000)\n\t@Path(\"/{userId}/ai-setting\")\n    @POST\n    public Response setAiSetting(@PathParam(\"userId\") Long userId, @NotNull AiSetting aiSetting) {\n    \tUser user = userService.load(userId);\n\t\tif (user.isDisabled()) {\n\t\t\tthrow new ExplicitException(\"Cannot set password for disabled account\");","sourceCodeStart":482,"sourceCodeEnd":518,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java#L482-L518","documentation":"A non-administrator can only change their own password via this endpoint, and only if the account actually has a local password. If user.getPassword() is null, the account is authenticated through an external system (LDAP, SSO, OAuth, etc.), so OneDev rejects local password changes and tells the user to change the password in the external system.","triggerScenarios":"A user changing their own password (not admin path) on an account backed by external authentication (no local password stored).","commonSituations":"Company uses LDAP/SSO login; an employee tries to change password via OneDev REST or profile page; migrating from external auth without setting an initial local password.","solutions":["Change the password in the external identity provider (LDAP/SSO) instead","Ask an administrator to set the password via the admin path (which bypasses this check)","If local login is desired, migrate the account to local authentication so a password field exists"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const user = await rest.get(`/users/${userId}`); if (user.external || user.password == null) throw new Error('Account is externally authenticated; change password at the identity provider');","typeGuard":"function hasLocalPassword(user) { return user.password != null; }","tryCatchPattern":"try { await rest.post(`/users/${id}/password`, {password}); } catch (e) { if (e.status === 400 && /external system/.test(e.message)) { /* redirect user to SSO/LDAP password change */ } else throw e; }","preventionTips":["Detect external authentication before offering local password change","Point users at the corporate SSO/LDAP password portal","Have admins set local passwords via the admin path when migration is intended"],"tags":["rest-api","password","sso","ldap","external-auth","onedev"],"backgroundTag":"external-auth-provider-managed-account","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}