https://medplum.com logo
Join Discord
Powered by
user not found
# support
n
Hello, I have a self hosted install on ubuntu, and i am having trouble with inviting users. Whenever I invite users through the API and complete the set-password flow that user is created, has a project membership, and a password hash. But whenever I go to log in with that user i get user not found. If I use the medplum UI to invite the user the user is able to log in. I am unsure what I am doing wrong. The user is created as a project scoped user and the user objects and project membership objects between a working user and a broken one are identical. What should I check to diagnose the issue? this is my invite call membership = await medplum.invite(projectId, { resourceType: 'Practitioner', firstName, lastName, email: emailToUse, sendEmail: false, accessPolicy: { reference: 
AccessPolicy/${accessPolicyId}
, display: Object.keys(ROLE_ACCESS_POLICIES).find(key => ROLE_ACCESS_POLICIES[key] === accessPolicyId) || 'Sleep Tech', }, scope: 'project', admin: isAdmin, mfaRequired: false }); and it does create a userSecurityRequest which triggers a bot that sends an email with the userSecurityRequest ID and secret which is properly exchanged to set the users password. Here is a screenshot of the login failing as well as their project membership and user. I have been beating my head against this for serveral days now and any help would be very appreciated. https://cdn.discordapp.com/attachments/1448301111155884042/1448301111483043840/image.png?ex=69415a85&is=69400905&hm=a6f659d66658c4f28ed0b7a6b0dac03a50d6c4e9588fb2dbee359d5a292fb4bf& https://cdn.discordapp.com/attachments/1448301111155884042/1448301112129097849/image.png?ex=69415a85&is=69400905&hm=880d68fa932238b275408e847ed8e2243a95fbf92153b109fef8f10749e60fb8& https://cdn.discordapp.com/attachments/1448301111155884042/1448301112456249344/image.png?ex=69415a85&is=69400905&hm=5d6e51c682961faf889665bb182a8ae87b67749649b5fe51cc269919bc624d00&
f
Hi @nate06613 , could you send the payload being sent on your 
.../login
request?
n
sure here it is {"email":"nate@elevaresolutions.com","password":"MarioMan1988!","remember":true,"projectId":"db1db704-c7ee-4f78-b847-8ee9160a003f","codeChallengeMethod":"S256","codeChallenge":"-wQ4Y4ioHKzZE9n4RpcZXuBCNAE4eRf7qs-EEhSCdDQ","clientId":"bf34cf53-46e3-4ec2-a7e8-51cd4db59a44"}
also its strange I have another user that is identical exept the email address that I created directly instead of through the invite and it is able to log in just fine with the same login payload structure. Here is the working user payload {"email":"nphilli3@gmail.com","password":"MarioMan1988!@","remember":true,"projectId":"db1db704-c7ee-4f78-b847-8ee9160a003f","codeChallengeMethod":"S256","codeChallenge":"Y2WJLljyH9rw9sxK-Zqzo9iJAxIFCk95WnjKCJnd3pc","clientId":"bf34cf53-46e3-4ec2-a7e8-51cd4db59a44"}
f
can you confirm that the 
projectId
on yout login request matches the project on your 
User.project
field?
Can you help me understand what you mean by
Copy code
I created directly instead of through the invite
Under the hood, the medplum app actually calls the same 
.../invite
endpoint. Maybe inspect the network call that the medplum app is making, which is working, and cross reference that with the one that you are calling via API
Also, how are you authenticating before calling your 
.../login
. Are you authenticating with a User or ClientApplication within the project you are inviting the new User to?
n
Oh i am sorry I didnt clarify. When i am migrating my users from our old system to the new one i am calling the endpoint ${baseUrl}/admin/projects/${projectId}/invite But when i am inviting them as new users not migrated users i am using core medplum.invite is there a difference between these? the body of the requests are identical. But that is a good point. i will try to send it to the /invite enpoint instead of using the library and see if that helps.
f
Those both hit the same endpoint, so that should not be an issue.
How are you authenticating before calling 
medplum.invite
for new Users?
n
I am using teh medplum.startClientLogin() with my clientId
I did verify the client is the same client on the project these users are being placed on. it has an access policy that gives full access to all resources and is an admin on the project.
The projectId on the login request does match the project on the user.project field. Here is the user object from medplum { "resourceType": "User", "meta": { "project": "db1db704-c7ee-4f78-b847-8ee9160a003f", "versionId": "1d47b7b5-1597-47f2-9c58-45d969eb5649", "lastUpdated": "2025-12-10T04:53:23.991Z", "author": { "reference": "system" }, "compartment": [ { "reference": "Project/db1db704-c7ee-4f78-b847-8ee9160a003f" } ] }, "firstName": "Cow", "lastName": "Elevare", "email": "nate@elevaresolutions.com", "project": { "reference": "Project/db1db704-c7ee-4f78-b847-8ee9160a003f", "display": "PatientSafety" }, "mfaRequired": false, "id": "9bbf0672-a6e2-45f7-90e9-e180cc269e52", "emailVerified": true }
f
Ok can you also confirm that there is a ProjectMembership that references this User and the target Project?
the 
.../invite
endpoint should create both the project scoped User & ProjectMembership. If either is missing or misconfigured, then you will not be able to login with that User
n
yes here is the project membership object for that user. { "accessPolicy": { "reference": "AccessPolicy/ce090bea-6a41-47b5-9e35-41acb5832e85", "display": "Organization Admin" }, "admin": false, "resourceType": "ProjectMembership", "profile": { "reference": "Practitioner/91642e25-0a73-4282-a1c5-7f9817597d96", "display": "Cow Elevare" }, "id": "8121c549-276f-445b-b0fd-0ad5a20049bb", "meta": { "versionId": "192c4da9-bc2f-426f-b52e-d7b0dc6cd188", "lastUpdated": "2025-12-10T13:08:48.699Z", "author": { "reference": "Practitioner/af58a570-4958-495d-b352-d0f1b9f72d54", "display": "Nathanael Phillips" }, "project": "db1db704-c7ee-4f78-b847-8ee9160a003f", "compartment": [ { "reference": "Project/db1db704-c7ee-4f78-b847-8ee9160a003f" } ] }, "project": { "reference": "Project/db1db704-c7ee-4f78-b847-8ee9160a003f", "display": "PatientSafety" }, "user": { "reference": "User/9bbf0672-a6e2-45f7-90e9-e180cc269e52", "display": "nate@elevaresolutions.com" } }
ok i changed for both of my client flows to use const membershipResponse = await fetch(
${baseUrl}/admin/projects/${projectId}/invite
instead of the medplum core and i still have the same issue. The request bodies are identical. and both are using an admin token generated from loggin in with a client id and secret then getting a token from /oauth2/token and then using that token to send the request. It works fine in one flow. 100% of the time the other flow it creates the user the practitioner the userSecurityRequest, the membership everything. But when i go to log in "user not found" always comes up. Sorry, I just have never run into something like this where it feels like i am doing the exact same thing in 2 places but getting different results with no visible way to tell the difference between the users or any error message that makes sense. Like the user is there. 100% its there, I am staring right at it. why is it saying its not found?
dissreguard this whole thread I figured out what I was doing wrong.
thank you for your time
r
@nate06613 if you're willing - it would be great if you could share what the issue was. It would help us udpate the docs and help future users
n
The issue was I had 2 different configs for access policies on invite. I was using the wrong access policy numbers that did not exsist in the instance i was inviting the user in. If you are able to submit something to the devs it would be nice if i try to invite someone with an invalid access policy that it throws an error or in the body of the response it alerts that the access policy is invalid. Because from my perspective it went through and everything was set up. But it kept saying user not found instead of something like "user has invalid access policy unable to authenticate" or something.
r
Thanks so much for the feedback @nate06613 . We've made an update here: https://github.com/medplum/medplum/pull/8033
n
oh thats awsome! thank you so much!
46 Views
PreviousNext
Powered by