theonedev/onedev · error · ExplicitException

Cannot set primary email address for externally authenticate

Error message

Cannot set primary email address for externally authenticated user

What it means

Users authenticated through an external provider (e.g. LDAP, OAuth, SAML) have no local password. OneDev refuses to change the primary email address for such users via this endpoint because the primary address is tied to locally-authenticated account management. It throws ExplicitException.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/EmailAddressResource.java:105

		
		emailAddressService.create(emailAddress);

		if (!getAuthUser().equals(owner)) 
			auditService.audit(null, "added email address \"" + emailAddress.getValue() + "\" in account \"" + owner.getName() + "\" via RESTful API", null, null);
		return emailAddress.getId();
	}
	
	@Api(order=250, description="Set as primary email address")
	@Path("/primary")
	@POST
	public Long setAsPrimary(@NotNull Long emailAddressId) {
		var emailAddress = emailAddressService.load(emailAddressId);
		var owner = emailAddress.getOwner();
		if (!SecurityUtils.isAdministrator() && !owner.equals(getAuthUser()))
			throw new UnauthorizedException();
		
		if (owner.getPassword() == null)
			throw new ExplicitException("Cannot set primary email address for externally authenticated user");
		
		emailAddressService.setAsPrimary(emailAddress);

		if (!getAuthUser().equals(owner)) 
			auditService.audit(null, "set email address \"" + emailAddress.getValue() + "\" as primary in account \"" + owner.getName() + "\" via RESTful API", null, null);
		
		return emailAddressId;
	}
	
	@Api(order=260, description="Resend verification email")
	@Path("/resend-verification-email")
	@POST
	public Long resendVerificationEmail(@NotNull Long emailAddressId) {
		var emailAddress = emailAddressService.load(emailAddressId);
		if (!SecurityUtils.isAdministrator() && !emailAddress.getOwner().equals(getAuthUser()))
			throw new UnauthorizedException();

		if (settingService.getMailConnector() == null)

View on GitHub (pinned to d44925c47c)

Solutions

1. Change the primary address in the external identity provider instead
2. Set a local password for the user (convert to locally authenticated) before changing primary address
3. Update account settings through the external auth system's admin console

Example fix

// before
setAsPrimary(emailAddressId); // owner is SSO user
// after
if (owner.getPassword() != null) setAsPrimary(emailAddressId); else updatePrimaryInIdp(owner);

if (owner.getPassword() == null) route to external IdP instead of API;

boolean locallyAuthed = owner.getPassword() != null;

try { setAsPrimary(id); } catch (ExplicitException e) { /* externally authed: change in IdP */ }

When it happens

Trigger: POST to /primary for an email address whose owner.getPassword() == null (externally authenticated user).

Common situations: Organization uses SSO/LDAP so all users are externally authenticated; admin scripts assuming local accounts; users migrated from password auth to SSO.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The user is currently authenticated via external system, ple
• Name is already used by another SSO provider
• Reviewer not found:
• Assignee not found:
• Not authenticated

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/8ce046b94c5a703c. Report an issue: GitHub.