weaviate/weaviate · error

cannot enable adminlist and rbac at the same time

Error message

cannot enable adminlist and rbac at the same time

What it means

Authorization.Validate forbids enabling the static AdminList and dynamic RBAC simultaneously, since they are mutually exclusive authorization models in this version. Having both enabled is ambiguous, so startup fails.

Source

Thrown at usecases/config/authorization.go:32

import (
	"fmt"

	"github.com/weaviate/weaviate/usecases/auth/authorization/adminlist"
	"github.com/weaviate/weaviate/usecases/auth/authorization/rbac/rbacconf"
)

// Authorization configuration
type Authorization struct {
	AdminList adminlist.Config `json:"admin_list" yaml:"admin_list"`
	Rbac      rbacconf.Config  `json:"rbac" yaml:"rbac"`
}

// Validate the Authorization configuration. This only validates at a general
// level. Validation specific to the individual auth methods should happen
// inside their respective packages
func (a Authorization) Validate() error {
	if a.AdminList.Enabled && a.Rbac.Enabled {
		return fmt.Errorf("cannot enable adminlist and rbac at the same time")
	}

	if a.AdminList.Enabled {
		if err := a.AdminList.Validate(); err != nil {
			return fmt.Errorf("authorization adminlist: %w", err)
		}
	}

	if a.Rbac.Enabled {
		if err := a.Rbac.Validate(); err != nil {
			return fmt.Errorf("authorization rbac: %w", err)
		}
	}

	return nil
}

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Choose RBAC: set AUTHORIZATION_ADMINLIST_ENABLED=false and keep AUTHORIZATION_RBAC_ENABLED=true, assigning roles via the RBAC API.
2. Keep legacy adminlist: set AUTHORIZATION_RBAC_ENABLED=false and configure AUTHORIZATION_ADMINLIST_USER_GROUPS/users.
3. Re-encode existing adminlist permissions as RBAC roles before switching.

Example fix

// before
AUTHORIZATION_ADMINLIST_ENABLED: "true"
AUTHORIZATION_RBAC_ENABLED: "true"
// after
AUTHORIZATION_RBAC_ENABLED: "true"
AUTHORIZATION_ADMINLIST_ENABLED: "false"

adminlist := os.Getenv("AUTHORIZATION_ADMINLIST_ENABLED") == "true"
rbac := os.Getenv("AUTHORIZATION_RBAC_ENABLED") == "true"
if adminlist && rbac {
    return errors.New("choose either adminlist or rbac, not both")
}

When it happens

Trigger: Setting AUTHORIZATION_ADMINLIST_ENABLED=true together with AUTHORIZATION_RBAC_ENABLED=true (or both flags true in the config file).

Common situations: Migrating from adminlist-based setups to RBAC while leaving the old adminlist flags enabled; copy-pasting config blocks from two different examples.

Related errors

• can't init casbin %w
• authorization rbac: %w
• NAMESPACES_ENABLED=true requires RBAC to be enabled
• insufficient permissions to view role
• role grants a permission you do not hold

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/d046f58a8f745857. Report an issue: GitHub.