# Cannot change password with users.update method of REST API **URL:** https://forums.rocket.chat/t/cannot-change-password-with-users-update-method-of-rest-api/12204 **Category:** Development **Created:** [September 16, 2021, 11:25am UTC](https://forums.rocket.chat/t/cannot-change-password-with-users-update-method-of-rest-api/12204 "2021-09-16T11:25:49Z") **Posts on this page:** 8 **Page:** 1
### Author: ![igor-afterlogic](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/igor-afterlogic/32/2861_2.png) [@igor-afterlogic](https://forums.rocket.chat/u/igor-afterlogic) #### Post date: [September 16, 2021, 11:25am UTC](https://forums.rocket.chat/t/cannot-change-password-with-users-update-method-of-rest-api/12204/1 "2021-09-16T11:25:49Z")
We’re integrating Rocket.Chat with our platform, creating chat accounts with the same login and password users have in our system. Subsequently, when user password is changed in our system, we need to update chat account password as well - but we’re not able to do so, we are getting “TOTP Required [totp-required]” error. The documentation states that “Edit Other User Password” permission is required, administrator has such permission of course. We’re not sure if it’s a good idea to set such permission for a user though, sounds like they’ll be able to change each others’ password then; still we tried granting such permission and nothing has changed. Anyway, we’re using REST API from an administrator user, they create accounts successfully, unable to change passwords though. Do you think this may be a bug and submitting a bugreport may help? Thank you for all the help. ---
### Author: ![reetp](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/reetp/32/5546_2.png) [@reetp](https://forums.rocket.chat/u/reetp) #### Post date: [September 16, 2021, 12:09pm UTC](https://forums.rocket.chat/t/cannot-change-password-with-users-update-method-of-rest-api/12204/2 "2021-09-16T12:09:17Z")
> [@igor-afterlogic](#): > > [totp-required Hmm - it probably isn’t a bug. Search github for the error. That will lead you to these. > > > \### Description: > > The new version 3.6.0 is working fine when i update an exist…ing instance. But i am not able to start new ones. I am running automated scripts to build up my docker container whenever i want to. But it fails since 2FA is forced (if i understand it right) it fails at the point, where i want to change things like SiteURL or Admin user > https://rocket.chat/all-aboard-rocket-chat-3-6-is-here/ > "If you’re changing an important setting on your Admin panel or resetting an E2E Key, our system will now ask you for a 2-Factor Authentication code to proceed with the changes." > > This breaks the whole automatism thing... Correct me if i am wrong. > > \### Steps to reproduce: > 1. Start RC in 3.6 > 2. try to create Admin user or reset settings like SiteURL > 3. enjoy TOTP errors > > \### Expected behavior: > > No 2FA forced - because i think a lot of people are using automated setups, you can't use 2FA that way ... > > \### Actual behavior: > RC does not start. > > \### Server Setup Information: > > \- Version of Rocket.Chat Server: 3.6.0 > \- Operating System: node:12.18-slim docker > \- Deployment Method: docker > \- Number of Running Instances: \>10 > \- DB Replicaset Oplog: > \- NodeJS Version: 12.18 > \- MongoDB Version: v3.6.13 > > > \### Relevant logs: > > \`\`\` > infos of customer-admin: > rocketchat\_1 | {"user":{"\_id":"XXXXXXXXX","createdAt":"2020-09-08T08:41:14.283Z","name":"Administrator","username":"admin","status":"offline","utcOffset":0,"active":true,"emails":\[{"address":"example@mail.de","verified":false}\],"type":"user","services":{},"roles":\["admin"\]},"success":true} > > update customer-admin: > rocketchat\_1 | {"success":false,"error":"TOTP Required \[totp-required\]","errorType":"totp-required","details":{"method":"password","codeGenerated":false,"availableMethods":\[\]}} > > infos of general channel: > rocketchat\_1 | {"channel":{"\_id":"GENERAL","ts":"2020-09-08T08:41:13.861Z","t":"c","name":"general","usernames":\[\],"msgs":0,"usersCount":0,"default":true,"\_updatedAt":"2020-09-08T08:41:13.861Z"},"success":true} > > invite admin to general channel: > rocketchat\_1 | {"channel":{"\_id":"GENERAL","ts":"2020-09-08T08:41:13.861Z","t":"c","name":"general","usernames":\[\],"msgs":1,"usersCount":1,"default":true,"\_updatedAt":"2020-09-08T08:41:20.709Z"},"success":true} > > reset Site\_Url: > rocketchat\_1 | {"success":false,"error":"TOTP Required \[totp-required\]","errorType":"totp-required","details":{"method":"password","codeGenerated":false,"availableMethods":\[\]}} > > rocketchat\_1 | Customer admin could not be created - Aborting! > \`\`\` > > > \### Description: > > The new version 3.6.0 is working fine when i update an exist…ing instance. But i am not able to start new ones. I am running automated scripts to build up my docker container whenever i want to. But it fails since 2FA is forced (if i understand it right) it fails at the point, where i want to change things like SiteURL or Admin user > https://rocket.chat/all-aboard-rocket-chat-3-6-is-here/ > "If you’re changing an important setting on your Admin panel or resetting an E2E Key, our system will now ask you for a 2-Factor Authentication code to proceed with the changes." > > This breaks the whole automatism thing... Correct me if i am wrong. > > \### Steps to reproduce: > 1. Start RC in 3.6 > 2. try to create Admin user or reset settings like SiteURL > 3. enjoy TOTP errors > > \### Expected behavior: > > No 2FA forced - because i think a lot of people are using automated setups, you can't use 2FA that way ... > > \### Actual behavior: > RC does not start. > > \### Server Setup Information: > > \- Version of Rocket.Chat Server: 3.6.0 > \- Operating System: node:12.18-slim docker > \- Deployment Method: docker > \- Number of Running Instances: \>10 > \- DB Replicaset Oplog: > \- NodeJS Version: 12.18 > \- MongoDB Version: v3.6.13 > > > \### Relevant logs: > > \`\`\` > infos of customer-admin: > rocketchat\_1 | {"user":{"\_id":"XXXXXXXXX","createdAt":"2020-09-08T08:41:14.283Z","name":"Administrator","username":"admin","status":"offline","utcOffset":0,"active":true,"emails":\[{"address":"example@mail.de","verified":false}\],"type":"user","services":{},"roles":\["admin"\]},"success":true} > > update customer-admin: > rocketchat\_1 | {"success":false,"error":"TOTP Required \[totp-required\]","errorType":"totp-required","details":{"method":"password","codeGenerated":false,"availableMethods":\[\]}} > > infos of general channel: > rocketchat\_1 | {"channel":{"\_id":"GENERAL","ts":"2020-09-08T08:41:13.861Z","t":"c","name":"general","usernames":\[\],"msgs":0,"usersCount":0,"default":true,"\_updatedAt":"2020-09-08T08:41:13.861Z"},"success":true} > > invite admin to general channel: > rocketchat\_1 | {"channel":{"\_id":"GENERAL","ts":"2020-09-08T08:41:13.861Z","t":"c","name":"general","usernames":\[\],"msgs":1,"usersCount":1,"default":true,"\_updatedAt":"2020-09-08T08:41:20.709Z"},"success":true} > > reset Site\_Url: > rocketchat\_1 | {"success":false,"error":"TOTP Required \[totp-required\]","errorType":"totp-required","details":{"method":"password","codeGenerated":false,"availableMethods":\[\]}} > > rocketchat\_1 | Customer admin could not be created - Aborting! > \`\`\` > > > \### Additional: > > If i login via 2FA password like this: > > \`\`\` > loginInfo=$(curl -H "Content-type:application/json" -H "x-2fa-code: passw0rd" -H "x-2fa-method:password" http://localhost:3100/api/v1/login \\ > -d '{"user": "admin", "password": "passw0rd"}') > userId=$(echo $loginInfo | jq -r ".data.userId") > authToken=$(echo $loginInfo | jq -r ".data.authToken") > \`\`\` > Result: > \`rocket.chat rest api login info: {"status":"success","data":(...)}\` > > the login is ok but this fails due to > > "\`{"success":false,"error":"TOTP Invalid \[totp-invalid\]","errorType":"totp-invalid","details":{"method":"password"}}\`": > > \`\`\` > return\_msg=$(curl -H "X-Auth-Token: $authToken" \\ > -H "X-User-Id: $userId" -H "x-2fa-code:passw0rd" -H "x-2fa-method:password"\\ > -H "Content-type:application/json" \\ > http://localhost:3100/api/v1/settings/Site\_Url \\ > -d '{"value": "'$ROOT\_URL'"}') > \`\`\` > [@Not receiving emails anymore so cannot change settings as admin as TOTP is required](https://forums.rocket.chat/t/not-receiving-emails-anymore-so-cannot-change-settings-as-admin-as-totp-is-required/12124): > > Description Server Setup Information Version of Rocket.Chat Server: Operating System: Linux Deployment Method: docker Number of Running Instances: DB Replicaset Oplog: NodeJS Version: MongoDB Version: Proxy: Firewalls involved: Any additional Information I had the SMTP settings correctly enabled before but in order to disable the welcome emails users get (despite the setting being switch off) I removed the SMTP settings but unfortunately now my admin account isn’t getting the 2fa codes sent… ---
### Author: ![igor-afterlogic](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/igor-afterlogic/32/2861_2.png) [@igor-afterlogic](https://forums.rocket.chat/u/igor-afterlogic) #### Post date: [September 17, 2021, 7:15am UTC](https://forums.rocket.chat/t/cannot-change-password-with-users-update-method-of-rest-api/12204/3 "2021-09-17T07:15:51Z")
Thank you for the response. Sure, we did search through GitHub, unfortunately threads we found don’t seem to be relevant for the issue we’re facing. Upon experimenting with this further, it appears that the same issue occurs even if we don’t attempt modifying the password, changing **data.roles** results in the same error. If anyone is using [users.update](https://developer.rocket.chat/reference/api/rest-api/endpoints/team-collaboration-endpoints/users-endpoints/update-user) method with the latest Rocket.Chat version, we’d appreciate sharing an example of the method call that works for them. We utilize the method much like the one used to [create a user](https://developer.rocket.chat/reference/api/rest-api/endpoints/team-collaboration-endpoints/users-endpoints/create-user-endpoint), logged in as administrator account, and can’t figure out where our mistake could be. Thanks again. ---
### Author: ![igor-afterlogic](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/igor-afterlogic/32/2861_2.png) [@igor-afterlogic](https://forums.rocket.chat/u/igor-afterlogic) #### Post date: [September 17, 2021, 9:08am UTC](https://forums.rocket.chat/t/cannot-change-password-with-users-update-method-of-rest-api/12204/4 "2021-09-17T09:08:11Z")
Have attempted to do that directly via cURL according to [the documentation page](https://developer.rocket.chat/reference/api/rest-api/endpoints/team-collaboration-endpoints/users-endpoints/update-user), modifying just the name, not a password - same error: ```auto $ curl -H "X-Auth-Token: rEcvAe0uIk0ZRGveG1eIo4C8Zi88bxo3xkDrbLg-sAs" \ > -H "X-User-Id: kc3dBmjGnCBx6AG2g" \ > -H "Content-type:application/json" \ > https://chat.mydomain.com/api/v1/users.update \ > -d '{"userId": "FowAqkCqmagRdYKkm", "data": { "name": "new name"}}' % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 223 0 161 100 62 181 69 --:--:-- --:--:-- --:--:-- 181 {"success":false,"error":"TOTP Required [totp-required]","errorType":"totp-required","details":{"method":"password","codeGenerated":false,"availableMethods":[]}} ``` In theory, we could use [users.updateOwnBasicInfo](https://developer.rocket.chat/reference/api/rest-api/endpoints/team-collaboration-endpoints/users-endpoints/update-own-basic-information) but having no luck there either, getting Error 401 no matter what we send in data. ---
### Author: ![reetp](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/reetp/32/5546_2.png) [@reetp](https://forums.rocket.chat/u/reetp) #### Post date: [September 17, 2021, 12:34pm UTC](https://forums.rocket.chat/t/cannot-change-password-with-users-update-method-of-rest-api/12204/5 "2021-09-17T12:34:33Z")
> [@igor-afterlogic](#): > > `d [totp-required]","errorType":"totp-required","details":{"method":"password","codeGenerated":false,"avail` So you didn’t find this PR linked for the bugs above? [https://github.com/RocketChat/docs/pull/1799/files](https://github.com/RocketChat/docs/pull/1799/files) Which I believe is part of this: > **[REST Two Factor Authentication](https://developer.rocket.chat/reference/api/rest-api/endpoints/authentication-endpoints/rest-two-factor-authentication)** ---
### Author: ![igor-afterlogic](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/igor-afterlogic/32/2861_2.png) [@igor-afterlogic](https://forums.rocket.chat/u/igor-afterlogic) #### Post date: [September 17, 2021, 1:42pm UTC](https://forums.rocket.chat/t/cannot-change-password-with-users-update-method-of-rest-api/12204/6 "2021-09-17T13:42:05Z")
Oh wow, my mistake, somehow I didn’t think it applied to our case as we’re not using 2FA anywhere. But, sending **X-2fa-code** and **X-2fa-method** actually did help, everything worked like a charm. Thank you! ---
### Author: ![reetp](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/reetp/32/5546_2.png) [@reetp](https://forums.rocket.chat/u/reetp) #### Post date: [September 20, 2021, 8:25am UTC](https://forums.rocket.chat/t/cannot-change-password-with-users-update-method-of-rest-api/12204/7 "2021-09-20T08:25:52Z")
Fab! If this is the solution please mark this solved. ---
### Author: ![igor-afterlogic](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/igor-afterlogic/32/2861_2.png) [@igor-afterlogic](https://forums.rocket.chat/u/igor-afterlogic) #### Post date: [September 20, 2021, 10:05am UTC](https://forums.rocket.chat/t/cannot-change-password-with-users-update-method-of-rest-api/12204/8 "2021-09-20T10:05:40Z")
I tried doing that, but my account probably doesn’t have sufficient permissions for editing forum thread properties… Sorry about the trouble.