{"record":{"id":"d046f58a8f745857","repo":"weaviate/weaviate","slug":"cannot-enable-adminlist-and-rbac-at-the-same-time","errorCode":null,"errorMessage":"cannot enable adminlist and rbac at the same time","messagePattern":"cannot enable adminlist and rbac at the same time","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"usecases/config/authorization.go","lineNumber":32,"sourceCode":"import (\n\t\"fmt\"\n\n\t\"github.com/weaviate/weaviate/usecases/auth/authorization/adminlist\"\n\t\"github.com/weaviate/weaviate/usecases/auth/authorization/rbac/rbacconf\"\n)\n\n// Authorization configuration\ntype Authorization struct {\n\tAdminList adminlist.Config `json:\"admin_list\" yaml:\"admin_list\"`\n\tRbac      rbacconf.Config  `json:\"rbac\" yaml:\"rbac\"`\n}\n\n// Validate the Authorization configuration. This only validates at a general\n// level. Validation specific to the individual auth methods should happen\n// inside their respective packages\nfunc (a Authorization) Validate() error {\n\tif a.AdminList.Enabled && a.Rbac.Enabled {\n\t\treturn fmt.Errorf(\"cannot enable adminlist and rbac at the same time\")\n\t}\n\n\tif a.AdminList.Enabled {\n\t\tif err := a.AdminList.Validate(); err != nil {\n\t\t\treturn fmt.Errorf(\"authorization adminlist: %w\", err)\n\t\t}\n\t}\n\n\tif a.Rbac.Enabled {\n\t\tif err := a.Rbac.Validate(); err != nil {\n\t\t\treturn fmt.Errorf(\"authorization rbac: %w\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":14,"sourceCodeEnd":49,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/config/authorization.go#L14-L49","documentation":"Authorization.Validate forbids enabling the static AdminList and dynamic RBAC simultaneously, since they are mutually exclusive authorization models in this version. Having both enabled is ambiguous, so startup fails.","triggerScenarios":"Setting AUTHORIZATION_ADMINLIST_ENABLED=true together with AUTHORIZATION_RBAC_ENABLED=true (or both flags true in the config file).","commonSituations":"Migrating from adminlist-based setups to RBAC while leaving the old adminlist flags enabled; copy-pasting config blocks from two different examples.","solutions":["Choose RBAC: set AUTHORIZATION_ADMINLIST_ENABLED=false and keep AUTHORIZATION_RBAC_ENABLED=true, assigning roles via the RBAC API.","Keep legacy adminlist: set AUTHORIZATION_RBAC_ENABLED=false and configure AUTHORIZATION_ADMINLIST_USER_GROUPS/users.","Re-encode existing adminlist permissions as RBAC roles before switching."],"exampleFix":"// before\nAUTHORIZATION_ADMINLIST_ENABLED: \"true\"\nAUTHORIZATION_RBAC_ENABLED: \"true\"\n// after\nAUTHORIZATION_RBAC_ENABLED: \"true\"\nAUTHORIZATION_ADMINLIST_ENABLED: \"false\"","handlingStrategy":"validation","validationCode":"adminlist := os.Getenv(\"AUTHORIZATION_ADMINLIST_ENABLED\") == \"true\"\nrbac := os.Getenv(\"AUTHORIZATION_RBAC_ENABLED\") == \"true\"\nif adminlist && rbac {\n    return errors.New(\"choose either adminlist or rbac, not both\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Migrate fully to RBAC and remove legacy adminlist flags","Keep one authorization model per deployment","Grep deployment manifests for both flags in config review"],"tags":["configuration","authorization","rbac"],"backgroundTag":"conflicting-auth-config","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}