weaviate/weaviate · error

assigning roles to groups is not allowed

Error message

assigning roles to groups is not allowed

What it means

Policy error in assignRoleToGroup: role-to-group assignment is not permitted in this cluster configuration (the feature is gated off). The handler refuses the request after its early confinement/validity checks rather than forwarding it to the controller.

Source

Thrown at adapters/handlers/rest/authz/handlers_authz.go:877

		}
	}

	h.logger.WithFields(logrus.Fields{
		"action":                  "assign_roles",
		"component":               authorization.ComponentName,
		"user":                    principal.Username,
		"user_to_assign_roles_to": internalID,
		"roles":                   roleNames,
	}).Info("roles assigned to user")

	return authz.NewAssignRoleToUserOK()
}

func (h *authZHandlers) assignRoleToGroup(params authz.AssignRoleToGroupParams, principal *models.Principal) middleware.Responder {
	ctx := params.HTTPRequest.Context()

	if rolevisibility.CallerConfined(h.namespacesEnabled, principal) {
		return authz.NewAssignRoleToGroupForbidden().WithPayload(cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf("assigning roles to groups is not allowed")))
	}

	for _, role := range params.Body.Roles {
		if strings.TrimSpace(role) == "" {
			return authz.NewAssignRoleToGroupBadRequest().WithPayload(cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf("one or more of the roles you want to assign is empty")))
		}

		if err := validateEnvVarRoles(role); err != nil {
			return authz.NewAssignRoleToGroupForbidden().WithPayload(cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf("assigning: %w", err)))
		}
	}

	if len(params.Body.Roles) == 0 {
		return authz.NewAssignRoleToGroupBadRequest().WithPayload(cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf("roles can not be empty")))
	}

	groupType, err := validateUserTypeInput(string(params.Body.GroupType))
	if err != nil || groupType != authentication.AuthTypeOIDC {

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Assign roles to users instead of groups
2. Enable group-based RBAC if the deployment requires it

When it happens

Trigger: Thrown at adapters/handlers/rest/authz/handlers_authz.go:877 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/126b449912bd08e3. Report an issue: GitHub.