theonedev/onedev · error · DisabledAccountException

Account is disabled

Error message

Account is disabled

What it means

OneDev's AuthenticatingRealm (doGetAuthenticationInfo in DefaultAuthenticatingService) resolves the user by email or name during username/password login. If the resolved user has the 'disabled' flag set, authentication is aborted with a Shiro DisabledAccountException so no session is created. This is a deliberate policy check, not a bug: disabled users must not be able to authenticate even with valid credentials.

Source

Thrown at server-core/src/main/java/io/onedev/server/security/DefaultAuthenticatingService.java:143

			emailAddress.setVerificationCode(null);
			user.addEmailAddress(emailAddress);
			emailAddressService.create(emailAddress);
		}
		syncGroupsAndSshKeys(user, false, authenticated, defaultGroupName);
	}
	
	@Override
	protected final AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) 
			throws AuthenticationException {
		return transactionService.call(() -> {
			try {
				var userName = normalizeUserName((String) token.getPrincipal());
				var user = userService.findByVerifiedEmailAddress((String) token.getPrincipal());
				if (user == null) 
					user = userService.findByName(userName);
				if (user != null) {
					if (user.isDisabled())
						throw new DisabledAccountException(_T("Account is disabled"));
					else if (user.getType() != ORDINARY)
						throw new DisabledAccountException(_T("Service or AI account not allowed to login"));
					if (user.getPassword() == null) {
						var authenticator = settingService.getAuthenticator();
						if (authenticator != null) {
							var authenticated = authenticator.authenticate((UsernamePasswordToken) token);
							var emailAddressValue = authenticated.getEmail();
							if (emailAddressValue != null) {
								var emailAddress = emailAddressService.findByValue(emailAddressValue);
								if (emailAddress != null) {
									if (emailAddress.getOwner().equals(user) || !emailAddress.isVerified()) {
										updateUser(user, authenticated, emailAddress, authenticator.getDefaultGroup());
										return user;
									} else {
										throw new AuthenticationException(MessageFormat.format(_T("Email address \"{0}\" already used by another account"), emailAddressValue));
									}
								} else {
									updateUser(user, authenticated, null, authenticator.getDefaultGroup());

View on GitHub (pinned to d44925c47c)

Solutions

1. Have a OneDev administrator re-enable the account: Server Administration -> Users, select the user and clear the disabled setting.
2. If the account was disabled intentionally, switch automated clients to a different account or a service/access token of an enabled user.
3. Verify you are authenticating as the intended user (email vs name normalization may resolve an unexpected disabled account).
4. If the user should only lose UI access, consider permission-group restrictions instead of disabling, so integrations keep working.

Example fix

// before (admin keeps account disabled; job fails)
git clone http://disabled-user@onedev.example.com/project.git
// after (admin re-enables the user in Administration -> Users)
git clone http://enabled-user@onedev.example.com/project.git

// Before relying on a login, check the account state via API (admin):
User u = userService.findByName(name);
if (u != null && u.isDisabled()) { /* prompt admin to re-enable */ }

function canLogin(user) { return user != null && !user.isDisabled() && user.type === 'ORDINARY'; }

try {
  authenticate(username, password);
} catch (DisabledAccountException e) {
  logger.warn("Login rejected: account disabled - contact admin");
}

When it happens

Trigger: A login attempt (UsernamePasswordToken) via the web sign-in form, REST basic auth, or git credential auth where userService.findByVerifiedEmailAddress/findByName returns a user whose User.isDisabled() is true.

Common situations: An administrator disabled the account (e.g. offboarding a user or suspending an account for policy reasons) while the user still has stored credentials; CI jobs or git clients using that user's token/password suddenly fail with this message.

Related errors

• Authentication required
• This api can only be accessed via cluster credential
• Not authenticated
• Invalid or expired access token
• Service or AI account not allowed to login

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/333375f7c32109b9. Report an issue: GitHub.