nats-io/nats-server · error

authorized user on account %q using invalid connection type

Error message

authorized user on account %q using invalid connection type

What it means

convertAllowedConnectionTypes failed to parse the AllowedConnectionTypes in the auth callout's user JWT, and no valid connection types were produced, so the server rejects the user. AllowedConnectionTypes restricts which client protocols (e.g. "STAN", "MQTT", "WEBSOCKET", "LEAF") may use this user.

Source

Thrown at server/auth_callout.go:202

				return _EMPTY_, fmt.Errorf("account %q not permitted as valid account option for auth callout for account %q",
					arc.Issuer, account)
			}
		}
		return jwtIssuer, nil
	}

	getExpirationAndAllowedConnections := func(arc *jwt.UserClaims, account string) (time.Duration, map[string]struct{}, error) {
		allowNow, expiration := validateTimes(arc)
		if !allowNow {
			c.Errorf("Outside connect times")
			return 0, nil, fmt.Errorf("authorized user on account %q outside of valid connect times", account)
		}

		allowedConnTypes, err := convertAllowedConnectionTypes(arc.User.AllowedConnectionTypes)
		if err != nil {
			c.Debugf("%v", err)
			if len(allowedConnTypes) == 0 {
				return 0, nil, fmt.Errorf("authorized user on account %q using invalid connection type", account)
			}
		}
		return expiration, allowedConnTypes, nil
	}

	assignAccountAndPermissions := func(arc *jwt.UserClaims, account string) (*Account, error) {
		// Apply to this client.
		var err error
		issuerAccount, err := getIssuerAccount(arc, account)
		if err != nil {
			return nil, err
		}

		// if we are not in operator mode, they can specify placement as a tag
		var placement string
		if !isOperatorMode {
			// only allow placement if we are not in operator mode
			placement = arc.Audience

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Use only recognized connection type values in AllowedConnectionTypes (e.g. WEBSOCKET, MQTT, STAN, LEAF as supported by the server).
2. Check the server debug log (c.Debugf "%v", err) for the exact parse error and fix the offending entry.
3. Remove the AllowedConnectionTypes field entirely if the user should be unrestricted.

Example fix

// before
arc.User.AllowedConnectionTypes = []string{"web-socket"}
// after
arc.User.AllowedConnectionTypes = []string{"WEBSOCKET"}

valid := map[string]bool{"": true, "WEBSOCKET": true, "MQTT": true, "STAN": true, "LEAF": true}
for _, t := range arc.User.AllowedConnectionTypes {
    if !valid[t] {
        return fmt.Errorf("unknown connection type %q", t)
    }
}

When it happens

Trigger: The user JWT returned by the callout has User.AllowedConnectionTypes containing entries convertAllowedConnectionTypes cannot parse (unknown/misspelled type names), yielding err != nil and len(allowedConnTypes) == 0.

Common situations: Typo'd connection type strings (e.g. "websocket" casing/unknown value) in callout-generated claims; callout emitting an empty/garbage list where a parse error then leaves zero valid types.

Related errors

• operators do not allow authorization callouts to be configur
• authorization response had validation errors: %v
• error non operator mode account %q: attempted to use issuer_
• wrong issuer for auth callout response on account %q, expect
• account %q not permitted as valid account option for auth ca

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/3ad324cbc28e4e89. Report an issue: GitHub.