{"record":{"id":"e8c5a5bc6715f7d0","repo":"apolloconfig/apollo","slug":"create-or-update-user-operation-is-forbidden","errorCode":null,"errorMessage":"Create or update user operation is forbidden","messagePattern":"Create or update user operation is forbidden","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/UserController.java","lineNumber":102,"sourceCode":"    if (user == null) {\n      throw BadRequestException.userNotExists(userId);\n    }\n    return ResponseEntity.ok(OpenApiModelConverters.fromUserInfo(user));\n  }\n\n  @Override\n  public ResponseEntity<Void> createOrUpdateUser(OpenUserDTO openUserDTO, Boolean isCreate,\n      String operator) {\n    boolean consumerRequest = requireUserManagementMutationPermission(operator);\n    UserPO user = OpenApiModelConverters.toUserPO(openUserDTO);\n    if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {\n      throw new BadRequestException(\"Username and password can not be empty.\");\n    }\n\n    if (!consumerRequest && !unifiedPermissionValidator.isSuperAdmin()\n        && (!user.getUsername().equals(userInfoHolder.getUser().getUserId())\n            || user.getEnabled() != USER_ENABLED)) {\n      throw new AccessDeniedException(\"Create or update user operation is forbidden\");\n    }\n\n    CheckResult pwdCheckRes = passwordChecker.checkWeakPassword(user.getPassword());\n    if (!pwdCheckRes.isSuccess()) {\n      throw new BadRequestException(pwdCheckRes.getMessage());\n    }\n\n    if (userService instanceof SpringSecurityUserService) {\n      if (Boolean.TRUE.equals(isCreate)) {\n        ((SpringSecurityUserService) userService).create(user);\n      } else {\n        ((SpringSecurityUserService) userService).update(user);\n      }\n    } else {\n      throw new UnsupportedOperationException(\"Create or update user operation is unsupported\");\n    }\n    return ResponseEntity.ok().build();\n  }","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/UserController.java#L84-L120","documentation":"Thrown by createOrUpdateUser for a portal user request when the caller is not a super admin and either tries to modify a different user or tries to set enabled to a value other than enabled.","triggerScenarios":"Thrown when a caller without super-admin or user-management permission attempts to create or update a user through the OpenAPI UserController.","commonSituations":"Non-admin consumer token used; portal user lacks the manage-users role.","solutions":["Perform the operation as a super admin, or with a token (user token or consumer) that has the manage-users permission.","If creating/updating your own user as a regular portal user, set enabled to true and do not change other users."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}