apolloconfig/apollo · error · AccessDeniedException

Create or update user operation is forbidden

Error message

Create or update user operation is forbidden

What it means

Thrown by createOrUpdateUser for a portal user request when the caller is not a super admin and either tries to modify a different user or tries to set enabled to a value other than enabled.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/UserController.java:102

    if (user == null) {
      throw BadRequestException.userNotExists(userId);
    }
    return ResponseEntity.ok(OpenApiModelConverters.fromUserInfo(user));
  }

  @Override
  public ResponseEntity<Void> createOrUpdateUser(OpenUserDTO openUserDTO, Boolean isCreate,
      String operator) {
    boolean consumerRequest = requireUserManagementMutationPermission(operator);
    UserPO user = OpenApiModelConverters.toUserPO(openUserDTO);
    if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {
      throw new BadRequestException("Username and password can not be empty.");
    }

    if (!consumerRequest && !unifiedPermissionValidator.isSuperAdmin()
        && (!user.getUsername().equals(userInfoHolder.getUser().getUserId())
            || user.getEnabled() != USER_ENABLED)) {
      throw new AccessDeniedException("Create or update user operation is forbidden");
    }

    CheckResult pwdCheckRes = passwordChecker.checkWeakPassword(user.getPassword());
    if (!pwdCheckRes.isSuccess()) {
      throw new BadRequestException(pwdCheckRes.getMessage());
    }

    if (userService instanceof SpringSecurityUserService) {
      if (Boolean.TRUE.equals(isCreate)) {
        ((SpringSecurityUserService) userService).create(user);
      } else {
        ((SpringSecurityUserService) userService).update(user);
      }
    } else {
      throw new UnsupportedOperationException("Create or update user operation is unsupported");
    }
    return ResponseEntity.ok().build();
  }

View on GitHub (pinned to d95fc18d11)

Solutions

1. Perform the operation as a super admin, or with a token (user token or consumer) that has the manage-users permission.
2. If creating/updating your own user as a regular portal user, set enabled to true and do not change other users.

When it happens

Trigger: Thrown when a caller without super-admin or user-management permission attempts to create or update a user through the OpenAPI UserController.

Common situations: Non-admin consumer token used; portal user lacks the manage-users role.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/e8c5a5bc6715f7d0. Report an issue: GitHub.