theonedev/onedev · error · AuthenticationException

Email address "{0}" used by disabled account "{1}"

Error message

Email address "{0}" used by disabled account "{1}"

What it means

During SSO login, if the verified email from the identity provider belongs to an ordinary user whose account is disabled, OneDev refuses to authenticate, telling you the email is used by a disabled account. This prevents logging in through SSO while the matching local account is deactivated.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/page/security/SsoProcessPage.java:184

									user.addEmailAddress(emailAddress);
									emailAddressService.update(emailAddress);
								} else {
									throw new AuthenticationException(MessageFormat.format(_T("Email address \"{0}\" used by account \"{1}\""), authenticated.getEmail(), user.getName()));
								}
							}
							syncGroupsAndSshKeys(user, false);
							return user;
						}
					} 
					if (authenticated.getEmail() != null) {
						var emailAddress = emailAddressService.findByValue(authenticated.getEmail());
						if (emailAddress != null) {
							var user = emailAddress.getOwner();
							if (emailAddress.isVerified()) {
								if (user.getType() != ORDINARY) {
									emailAddressService.delete(emailAddress);
								} else if (user.isDisabled()) {
									throw new AuthenticationException(MessageFormat.format(_T("Email address \"{0}\" used by disabled account \"{1}\""), authenticated.getEmail(), user.getName()));
								} else {
									ssoAccount = new SsoAccount();
									ssoAccount.setUser(user);
									ssoAccount.setProvider(getProvider());
									ssoAccount.setSubject(authenticated.getSubject());
									ssoAccountService.create(ssoAccount);

									syncGroupsAndSshKeys(user, false);
									return user;
								}
							} else {
								emailAddressService.delete(emailAddress);
							}
						} 
					}
					return null;
				});
				if (aUser != null) 

View on GitHub (pinned to d44925c47c)

Solutions

1. Re-enable the user account in OneDev (Admin > Users, uncheck Disabled) if access should be restored.
2. If the user should not have access, remove or deactivate them in the identity provider so they can't attempt SSO.
3. Change the verified email on the disabled OneDev account if the email now legitimately belongs to someone else.

Example fix

// Admin: re-enable account
UPDATE user SET disabled = false WHERE name = 'john';
// or via UI: Admin -> Users -> john -> uncheck 'Disabled'

// Check the matching account is active before SSO login
var ea = OneDev.getInstance(EmailAddressService.class).findByEmailAddress(email);
if (ea != null && ea.isVerified() && ea.getOwner().isDisabled())
    // account disabled: do not attempt SSO, restore access first

When it happens

Trigger: SSO callback resolves authenticated.getEmail() to a verified email whose owner is an ORDINARY user with user.isDisabled() == true (SsoProcessPage.java:184).

Common situations: A user was disabled/deactivated (e.g. offboarding, license trimming, manual disable) but still has an active account in the identity provider and clicks the SSO login button; LDAP/SSO sync re-enables the IdP side but OneDev account stays disabled.

Related errors

• Email address "{0}" already used by another account
• Unable to change password as you are authenticating via exte
• Unable to find SSO provider:
• Email address "{0}" used by account "{1}"
• Authentication required

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/f6ed81dc8c3d6d52. Report an issue: GitHub.