infiniflow/ragflow · critical · AdminException

No active admin. Please update 'is_active' in db manually.

Error message

No active admin. Please update 'is_active' in db manually.

What it means

Raised at admin server startup (admin/server/auth.py:105) when superuser rows exist in the user table but none has is_active == ActiveEnum.ACTIVE.value. This means every admin was deactivated (e.g. blocked via the admin UI), leaving no usable administrator, so startup aborts with HTTP 500 and a message telling you to fix the flag directly in the database.

Source

Thrown at admin/server/auth.py:105

def init_default_admin():
    # Verify that at least one active admin user exists. If not, create a default one.
    users = UserService.query(is_superuser=True)
    if not users:
        default_admin = {
            "id": uuid.uuid1().hex,
            "password": encode_to_base64("admin"),
            "nickname": "admin",
            "is_superuser": True,
            "email": "admin@ragflow.io",
            "creator": "system",
            "status": "1",
        }
        if not UserService.save(**default_admin):
            raise AdminException("Can't init admin.", 500)
        add_tenant_for_admin(default_admin, UserTenantRole.OWNER)
    elif not any([u.is_active == ActiveEnum.ACTIVE.value for u in users]):
        raise AdminException("No active admin. Please update 'is_active' in db manually.", 500)
    else:
        default_admin_rows = [u for u in users if u.email == "admin@ragflow.io"]
        if default_admin_rows:
            default_admin = default_admin_rows[0].to_dict()
            exist, default_admin_tenant = TenantService.get_by_id(default_admin["id"])
            if not exist:
                add_tenant_for_admin(default_admin, UserTenantRole.OWNER)


def add_tenant_for_admin(user_info: dict, role: str):

    tenant = {
        "id": user_info["id"],
        "name": user_info["nickname"] + "‘s Kingdom",
        "llm_id": settings.CHAT_MDL,
        "embd_id": settings.EMBEDDING_MDL,
        "asr_id": settings.ASR_MDL,
        "parser_ids": settings.PARSERS,

View on GitHub (pinned to 554fb1133a)

Solutions

1. Directly update the DB as the message instructs: UPDATE user SET is_active = 1 WHERE is_superuser = 1 (ActiveEnum.ACTIVE is typically '1').
2. Alternatively INSERT/restore one superuser row with is_active=1 so the 'any(...)' check passes.
3. Prevent recurrence: never deactivate the last active superuser; guard admin-deactivation endpoints against removing the final active admin.

Example fix

-- before: no active admin, server refuses to start
SELECT id, email, is_active FROM user WHERE is_superuser = 1;

-- after: reactivate the admin in MySQL/Postgres
UPDATE user SET is_active = '1' WHERE is_superuser = 1 AND email = 'admin@ragflow.io';

from api.db.services import UserService
from common.constants import ActiveEnum
active_admins = [u for u in UserService.query(is_superuser=True) if u.is_active == ActiveEnum.ACTIVE.value]
assert active_admins, "no active superuser; server will refuse to start"

def has_active_superuser() -> bool:
    users = UserService.query(is_superuser=True) or []
    return any(u.is_active == ActiveEnum.ACTIVE.value for u in users)

from api.common.exceptions import AdminException
try:
    start_admin_server()
except AdminException as e:
    if "No active admin" in str(e):
        # UPDATE user SET is_active='1' WHERE is_superuser=1, then restart
        raise

When it happens

Trigger: Calling the deactivate/block admin endpoint on the only superuser, then restarting the server; or manually editing the user table and setting is_active to the INACTIVE value for all superusers. Any restart of the admin server while the condition holds re-raises this.

Common situations: Teams with a single admin account who disable it (status/is_active flip) to 'temporarily lock' the panel; importing a production DB snapshot where admins were soft-deleted; scripts that bulk-deactivate users without excluding superusers.

Related errors

• Can't init admin.
• not implement: update user role: {user_name} to role {role_n
• User '{username}' not found
• Email and password do not match!
• User {email} inactive

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/f75a1089570e9a93. Report an issue: GitHub.