nats-io/nats-server · error

authorized user on account

Error message

authorized user on account %q using invalid connection type

What it means

convertAllowedConnectionTypes failed to parse the AllowedConnectionTypes in the auth callout's user JWT, and no valid connection types were produced, so the server rejects the user. AllowedConnectionTypes restricts which client protocols (e.g. "STAN", "MQTT", "WEBSOCKET", "LEAF") may use this user.

Solutions

1. Use only recognized connection type values in AllowedConnectionTypes (e.g. WEBSOCKET, MQTT, STAN, LEAF as supported by the server).
2. Check the server debug log (c.Debugf "%v", err) for the exact parse error and fix the offending entry.
3. Remove the AllowedConnectionTypes field entirely if the user should be unrestricted.

Example fix

// before
arc.User.AllowedConnectionTypes = []string{"web-socket"}
// after
arc.User.AllowedConnectionTypes = []string{"WEBSOCKET"}

valid := map[string]bool{"": true, "WEBSOCKET": true, "MQTT": true, "STAN": true, "LEAF": true}
for _, t := range arc.User.AllowedConnectionTypes {
    if !valid[t] {
        return fmt.Errorf("unknown connection type %q", t)
    }
}

When it happens

Trigger: The user JWT returned by the callout has User.AllowedConnectionTypes containing entries convertAllowedConnectionTypes cannot parse (unknown/misspelled type names), yielding err != nil and len(allowedConnTypes) == 0.

Common situations: Typo'd connection type strings (e.g. "websocket" casing/unknown value) in callout-generated claims; callout emitting an empty/garbage list where a parse error then leaves zero valid types.

Related errors

• account not permitted as valid account option for auth…
• authorization response had validation errors
• authorized user on account
• error non operator mode account
• no valid account for auth callout response on account

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/3ad324cbc28e4e89. Report an issue: GitHub.

Appendix: source

Thrown at server/auth_callout.go:202

				return _EMPTY_, fmt.Errorf("account %q not permitted as valid account option for auth callout for account %q",
					arc.Issuer, account)
			}
		}
		return jwtIssuer, nil
	}

	getExpirationAndAllowedConnections := func(arc *jwt.UserClaims, account string) (time.Duration, map[string]struct{}, error) {
		allowNow, expiration := validateTimes(arc)
		if !allowNow {
			c.Errorf("Outside connect times")
			return 0, nil, fmt.Errorf("authorized user on account %q outside of valid connect times", account)
		}

		allowedConnTypes, err := convertAllowedConnectionTypes(arc.User.AllowedConnectionTypes)
		if err != nil {
			c.Debugf("%v", err)
			if len(allowedConnTypes) == 0 {
				return 0, nil, fmt.Errorf("authorized user on account %q using invalid connection type", account)
			}
		}
		return expiration, allowedConnTypes, nil
	}

	assignAccountAndPermissions := func(arc *jwt.UserClaims, account string) (*Account, error) {
		// Apply to this client.
		var err error
		issuerAccount, err := getIssuerAccount(arc, account)
		if err != nil {
			return nil, err
		}

		// if we are not in operator mode, they can specify placement as a tag
		var placement string
		if !isOperatorMode {
			// only allow placement if we are not in operator mode
			placement = arc.Audience

View on GitHub (pinned to 3a66a489d2)