apolloconfig/apollo · error · UnsupportedOperationException

Create or update user operation is unsupported

Error message

Create or update user operation is unsupported

What it means

Thrown by UserInfoController.createOrUpdateUser when the caller is NOT a super-admin AND either the target username differs from the logged-in user, or the request tries to set enabled != 1. It is an UnsupportedOperationException (authorization guard) — typically HTTP 500/403 depending on handler. Only super-admins may create users or change another user's record; a non-admin may only edit their own account while keeping enabled=1.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java:78

    this.userInfoHolder = userInfoHolder;
    this.logoutHandler = logoutHandler;
    this.userService = userService;
    this.passwordChecker = passwordChecker;
    this.unifiedPermissionValidator = unifiedPermissionValidator;
  }

  @PostMapping("/users")
  public void createOrUpdateUser(
      @RequestParam(value = "isCreate", defaultValue = "false") boolean isCreate,
      @RequestBody UserPO user) {
    if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {
      throw new BadRequestException("Username and password can not be empty.");
    }

    if (!unifiedPermissionValidator.isSuperAdmin()
        && (!user.getUsername().equals(userInfoHolder.getUser().getUserId())
            || user.getEnabled() != USER_ENABLED)) {
      throw new UnsupportedOperationException("Create or update user operation is unsupported");
    }

    CheckResult pwdCheckRes = passwordChecker.checkWeakPassword(user.getPassword());
    if (!pwdCheckRes.isSuccess()) {
      throw new BadRequestException(pwdCheckRes.getMessage());
    }

    if (userService instanceof SpringSecurityUserService) {
      if (isCreate) {
        ((SpringSecurityUserService) userService).create(user);
      } else {
        ((SpringSecurityUserService) userService).update(user);
      }
    } else {
      throw new UnsupportedOperationException("Create or update user operation is unsupported");
    }
  }

View on GitHub (pinned to d95fc18d11)

Solutions

1. Perform user creation/management as a user holding the super-admin role (apollo portal superAdmins config).
2. If editing your own account, ensure username equals your own userId and enabled stays 1.
3. Grant the acting user super-admin via portal's superAdmin list (portal DB / config) if they should manage users.
4. Use the dedicated PUT /users/enabled endpoint (super-admin only) to toggle enabled state.

Example fix

// before: non-admin tries to create another user
user.setUsername("bob"); user.setEnabled(1); postUsers(user, true);

// after: only super-admin may do this; check role client-side
if (!permissionValidator.isSuperAdmin()) {
  throw new AccessDeniedException("only super-admin can create users");
}
postUsers(user, true);

boolean selfEditOk = user.getUsername().equals(currentUserId) && user.getEnabled() == 1;
if (!isSuperAdmin && !selfEditOk) {
  return ResponseEntity.status(HttpStatus.FORBIDDEN).body("only super-admin may manage other users");
}

boolean canManageUser(UserPO target, String currentUserId, boolean isSuperAdmin) {
  return isSuperAdmin || (target.getUsername().equals(currentUserId) && target.getEnabled() == 1);
}

When it happens

Trigger: A non-super-admin POST /users whose username != their own userId, or whose enabled != USER_ENABLED(1). Also when a regular user attempts to disable/enable themselves or set enabled=0.

Common situations: A team-admin role (not super-admin) tries to provision a teammate; a user tries to self-disable; permission validator mis-configured so an intended admin lacks the super-admin flag.

Related errors

• User token operation is not allowed:%s
• Not supported operation
• userIds should not be null or empty
• Assign role permission is required
• App not found: {appId}

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/1484244d7b01f044. Report an issue: GitHub.