{"record":{"id":"df6116c5c48ca604","repo":"nats-io/nats-server","slug":"no-auth-user-s-not-present-as-user-or-nkey-in","errorCode":null,"errorMessage":"no_auth_user: \"%s\" not present as user or nkey in authorization block or account configuration","messagePattern":"no_auth_user: \"(.+?)\" not present as user or nkey in authorization block or account configuration","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":1792,"sourceCode":"\t}\n\tif len(o.TrustedOperators) > 0 {\n\t\treturn fmt.Errorf(\"no_auth_user not compatible with Trusted Operator\")\n\t}\n\n\tif o.Nkeys == nil && o.Users == nil {\n\t\treturn fmt.Errorf(`no_auth_user: \"%s\" present, but users/nkeys are not defined`, noAuthUser)\n\t}\n\tfor _, u := range o.Users {\n\t\tif u.Username == noAuthUser {\n\t\t\treturn nil\n\t\t}\n\t}\n\tfor _, u := range o.Nkeys {\n\t\tif u.Nkey == noAuthUser {\n\t\t\treturn nil\n\t\t}\n\t}\n\treturn fmt.Errorf(\n\t\t`no_auth_user: \"%s\" not present as user or nkey in authorization block or account configuration`,\n\t\tnoAuthUser)\n}\n\nfunc validateProxies(o *Options) error {\n\tif o.Proxies == nil {\n\t\treturn nil\n\t}\n\tfor _, p := range o.Proxies.Trusted {\n\t\tif !nkeys.IsValidPublicKey(p.Key) {\n\t\t\treturn fmt.Errorf(\"proxy trusted key %q is invalid\", p.Key)\n\t\t}\n\t}\n\treturn nil\n}\n\n// Create a list of nkeys.KeyPair corresponding to the public keys\n// of the Proxies.TrustedKeys list.","sourceCodeStart":1774,"sourceCodeEnd":1810,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L1774-L1810","documentation":"The no_auth_user option names an identity that was not found among the configured users or nkeys. For no_auth_user to work, it must exactly match a username in the authorization block, an account's user list, or an nkey entry, so the server can borrow those credentials for anonymous clients.","triggerScenarios":"validateNoAuthUser completes the loops over o.Users and o.Nkeys without finding a Username/Nkey equal to noAuthUser, then returns this error. Typical when the name is misspelled, defined only in an account not loaded, or has different case.","commonSituations":"Typo between no_auth_user and the users entry, user defined in a config section that failed to load or was removed, whitespace/case mismatch, or user defined only inside an account while server-level check expected it in the authorization block.","solutions":["Make no_auth_user exactly match an existing username or nkey public key in the config.","Check spelling, case, and whitespace of both no_auth_user and the user/nkey entries.","Confirm the config file actually defines the user (not commented out) and reload the server.","Remove no_auth_user if anonymous access is not needed."],"exampleFix":"// before\nno_auth_user: Guest\nusers = [ { user: guest, password: pwd } ]\n// after\nno_auth_user: guest\nusers = [ { user: guest, password: pwd } ]","handlingStrategy":"validation","validationCode":"found := false\nfor _, u := range opts.Users { if u.Username == opts.NoAuthUser { found = true } }\nfor _, n := range opts.Nkeys { if n.Nkey == opts.NoAuthUser { found = true } }\nif opts.NoAuthUser != \"\" && !found { return fmt.Errorf(\"%q not found\", opts.NoAuthUser) }","typeGuard":null,"tryCatchPattern":"if err := validateOptions(opts); err != nil {\n    if strings.Contains(err.Error(), \"not present as user or nkey\") {\n        log.Fatalf(\"no_auth_user mismatch: %v\", err)\n    }\n}","preventionTips":["Keep no_auth_user value copied verbatim from the users entry","Check case and whitespace on both sides","Verify the user's config section isn't commented out","Use `nats-server -t` to catch it before startup"],"tags":["config","authentication","nats"],"backgroundTag":"no-auth-user-not-defined","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}