n8n-io/n8n · warning · BadRequestError

${ssoIdentity.providerType.toUpperCase()} user may not chang

Error message

${ssoIdentity.providerType.toUpperCase()} user may not change their profile information

What it means

A BadRequestError (HTTP 400) from updateProfile when the user is attempting to change email/firstName/lastName and userService.findSsoIdentity(userId) returns an active SSO auth identity. SSO-authenticated users (SAML/LDAP) have their profile attributes managed by the IdP, so profile changes via the API are rejected. The provider type is uppercased into the message.

Source

Thrown at packages/cli/src/controllers/me.controller.ts:84

		const { currentPassword, ...payloadWithoutPassword } = payload;
		const { email, firstName, lastName } = payload;
		const isEmailBeingChanged = email !== currentEmail;
		const isFirstNameChanged = firstName !== currentFirstName;
		const isLastNameChanged = lastName !== currentLastName;

		// Check if the user is authenticated via SSO - they cannot change their profile info
		if (isEmailBeingChanged || isFirstNameChanged || isLastNameChanged) {
			const ssoIdentity = await this.userService.findSsoIdentity(userId);

			if (ssoIdentity && this.isAuthIdentityActive(ssoIdentity)) {
				this.logger.debug(
					`Request to update user failed because ${ssoIdentity.providerType} user may not change their profile information`,
					{
						userId,
						payload: payloadWithoutPassword,
					},
				);
				throw new BadRequestError(
					`${ssoIdentity.providerType.toUpperCase()} user may not change their profile information`,
				);
			}
		}

		await this.validateChangingUserEmail(req.user, payload);

		await this.externalHooks.run('user.profile.beforeUpdate', [
			userId,
			currentEmail,
			payloadWithoutPassword,
		]);

		const preUpdateUser = await this.userRepository.findOneByOrFail({ id: userId });
		await this.userService.update(userId, payloadWithoutPassword);
		const user = await this.userService.findUserWithAuthIdentities(userId);

		this.logger.info('User updated successfully', { userId });

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Update the user's profile attributes in the Identity Provider (SAML/LDAP directory) instead of the n8n API.
2. Wait for the next SSO login to sync the corrected attributes into n8n.
3. If the SSO identity is stale/inactive, an admin can deactivate it so the user may self-edit again.

// If the user has an active SSO identity, block profile edits client-side.
const identities = await api.get(`/users/${me.id}/sso-identities`);
const hasActiveSso = identities.some((i) => i.status === 'active');
if (hasActiveSso && profileFieldsChanged(payload, me)) {
  throw new Error('Profile is managed by your Identity Provider.');
}

function hasActiveSsoIdentity(ids: Array<{ status: string }>): boolean {
  return ids.some((i) => i.status === 'active');
}

try {
  await api.patch('/me', payload);
} catch (e) {
  if (e.response?.status === 400 && /may not change their profile/i.test(e.response.data.message)) {
    notify('Update your profile in your Identity Provider.');
    return;
  }
  throw e;
}

When it happens

Trigger: PATCH /me with a changed email, firstName, or lastName where the user has an active SSO auth identity (e.g. signed in via SAML). The check runs only when at least one of those three fields is being changed.

Common situations: A SAML/LDAP user tries to rename themselves in the UI; an IdP rename has not propagated and the user attempts a manual override; mixed-mode instance where a user has both a password and an SSO identity.

Related errors

• SAML user may not change their email
• SSO is enabled, so users are managed by the Identity Provide
• Invite links are not supported on this system, please use si
• This account is managed via environment variables and cannot
• 400

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/34e2cb821097f68b. Report an issue: GitHub.