2 files changed, 23 insertions, 3 deletions

diff --git a/server/middlewares/validators/users.js b/server/middlewares/validators/users.js
index e540ab0d1..5defdf4e3 100644
--- a/server/middlewares/validators/users.js
+++ b/server/middlewares/validators/users.js
@@ -17,11 +17,20 @@ function usersAdd (req, res, next) {
   req.checkBody('username', 'Should have a valid username').isUserUsernameValid()
   req.checkBody('password', 'Should have a valid password').isUserPasswordValid()
 
-  // TODO: check we don't have already the same username
-
   logger.debug('Checking usersAdd parameters', { parameters: req.body })
 
-  checkErrors(req, res, next)
+  checkErrors(req, res, function () {
+    User.loadByUsername(req.body.username, function (err, user) {
+      if (err) {
+        logger.error('Error in usersAdd request validator.', { error: err })
+        return res.sendStatus(500)
+      }
+
+      if (user) return res.status(409).send('User already exists.')
+
+      next()
+    })
+  })
 }
 
 function usersRemove (req, res, next) {
diff --git a/server/tests/api/check-params.js b/server/tests/api/check-params.js
index 4f7b26561..e361147bb 100644
--- a/server/tests/api/check-params.js
+++ b/server/tests/api/check-params.js
@@ -590,6 +590,17 @@ describe('Test parameters validator', function () {
         requestsUtils.makePostBodyRequest(server.url, path, server.accessToken, data, done, 204)
       })
 
+      it('Should fail if we add a user with the same username', function (done) {
+        it('Should succeed with the correct params', function (done) {
+          const data = {
+            username: 'user1',
+            password: 'my super password'
+          }
+
+          requestsUtils.makePostBodyRequest(server.url, path, server.accessToken, data, done, 409)
+        })
+      })
+
       it('Should fail with a non admin user', function (done) {
         server.user = {
           username: 'user1',