langfuse/langfuse · error

userName is required

Error message

userName is required

What it means

SCIM user creation requires a userName (the user's login/email). If the body lacks userName, creation is rejected with 400 before anything else happens.

Source

Thrown at web/src/pages/api/public/scim/Users/index.ts:189

          });
        }
      }

      // A `password` in the request body is accepted and ignored. Setting it
      // created a usable login credential for an email address nobody had
      // verified, so an org-scoped key could pre-register an account for
      // someone else's address. Ignoring rather than rejecting is deliberate:
      // RFC 7644 3.3 lets a service provider ignore POSTed content, the
      // attribute is `returned: "never"` so no conformant client can observe
      // the difference, and Okta sends a placeholder password on every create
      // even when password sync is disabled — rejecting it would break those
      // syncs. Users authenticate via SSO, or claim the account through the
      // password-reset flow.
      const { userName, name, displayName, roles } = body;

      if (!userName) {
        logger.warn("[SCIM] userName is required for user creation");
        return res.status(400).json({
          schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
          detail: "userName is required",
          status: 400,
        });
      }

      let role: Role = "NONE";
      if (roles && Array.isArray(roles) && roles.length > 0) {
        const roleSchema = z.array(
          z.enum(["OWNER", "ADMIN", "MEMBER", "VIEWER", "NONE"]),
        );
        const parsedRoles = roleSchema.safeParse(roles);
        if (!parsedRoles.success) {
          logger.warn("[SCIM] Invalid roles provided for user creation");
          return res.status(400).json({
            schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
            detail: `Invalid roles provided: ${JSON.stringify(roles)}, must be one of OWNER, ADMIN, MEMBER, VIEWER, NONE`,
            status: 400,

View on GitHub (pinned to 59d92c7cf3)

Solutions

1. Set userName in the POST body (typically the user's email)
2. Fix the IdP's attribute mapping so the email/login attribute maps to userName
3. Test creation with a minimal known-good payload first

Example fix

// before
{ "schemas": [...], "name": { "givenName": "Jane" } }
// after
{ "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"], "userName": "jane@corp.com", "name": { "givenName": "Jane" } }

if (!payload.userName || typeof payload.userName !== 'string') throw new Error('userName (email) is required for SCIM user creation');

const hasUserName = (b: any): b is { userName: string } => typeof b?.userName === 'string' && b.userName.length > 0;

When it happens

Trigger: POST /api/public/scim/Users with a body that has no userName field (or an empty value).

Common situations: IdP attribute mapping not sending the email/login attribute; placeholder test payloads; mapping configured to a custom attribute Langfuse ignores.

Related errors

• Invalid roles provided: ${JSON.stringify(roles)}, must be on
• Invalid request body
• Invalid request body
• Invalid request body
• Invalid project name. Should be between 3 and 60 characters.

AI-assisted analysis of langfuse/langfuse@59d92c7cf3 (2026-08-27). Data as JSON: /api/errors/b822567faf899148. Report an issue: GitHub.