apolloconfig/apollo · error · BadRequestException

User is disabled

Error message

User is disabled

What it means

Thrown by UserTokenService.validateUserEnabled() when the operator's UserInfo exists but has an enabled field not equal to 1 (USER_ENABLED). This check runs during createToken() — disabled users cannot create new tokens. Note that authenticate() (token validation at request time) also silently returns null for disabled users. BadRequestException → HTTP 400.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/UserTokenService.java:380

      throw BadRequestException.rateLimitIsInvalid();
    }
    if (request.getNamespaces() == null) {
      return;
    }
    for (UserTokenNamespaceScope namespaceScope : request.getNamespaces()) {
      if (namespaceScope == null) {
        throw new BadRequestException("Token namespace scope can not be null");
      }
    }
  }

  private void validateUserEnabled(String userId) {
    UserInfo userInfo = userService.findByUserId(userId);
    if (userInfo == null) {
      throw BadRequestException.userNotExists(userId);
    }
    if (userInfo.getEnabled() != USER_ENABLED) {
      throw new BadRequestException("User is disabled");
    }
  }

  private Date resolveExpires(Date requestedExpires, Date now) {
    Date expires = requestedExpires;
    if (expires == null) {
      Calendar calendar = Calendar.getInstance();
      calendar.setTime(now);
      calendar.add(Calendar.DAY_OF_YEAR, portalConfig.userTokenDefaultExpireDays());
      expires = calendar.getTime();
    }
    if (!expires.after(now)) {
      throw new BadRequestException("Token expires must be in the future");
    }

    Calendar maxCalendar = Calendar.getInstance();
    maxCalendar.setTime(now);
    maxCalendar.add(Calendar.DAY_OF_YEAR, portalConfig.userTokenMaxExpireDays());

View on GitHub (pinned to d95fc18d11)

Solutions

1. Have an administrator re-enable the user account (set enabled=1) in the user management interface.
2. Use a different, enabled user account to create the token.
3. If the operator is a service account, ensure it is not disabled in the user store.

Example fix

// Not a code fix — requires admin action in the portal user management UI to re-enable the account.

UserInfo userInfo = userService.findByUserId(operator);
if (userInfo == null || userInfo.getEnabled() != 1) {
    throw new IllegalStateException("User account is disabled or does not exist: " + operator);
}
userTokenService.createToken(request, operator);

static boolean isUserEnabled(UserInfo userInfo) {
    return userInfo != null && userInfo.getEnabled() == 1;
}

try {
    userTokenService.createToken(request, operator);
} catch (BadRequestException e) {
    if (e.getMessage().contains("User is disabled")) {
        return Response.status(400).entity("Account is disabled — contact an administrator").build();
    }
    throw e;
}

When it happens

Trigger: A user whose portal account has been disabled (enabled=0) attempts to create a new access token via createToken(). The userService.findByUserId() lookup succeeds (the user record exists) but userInfo.getEnabled() != 1.

Common situations: An administrator disabled the user's account but the user still has an active session or API client attempting token operations. User was deactivated as part of offboarding but automation still tries to create tokens on their behalf.

Related errors

• Token is not active
• Invalid user token status:%s
• Invalid user token operation:%s
• User token operation is not allowed:%s
• Token name can not be blank

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/4d4bc9f810e3e28d. Report an issue: GitHub.