diff --git a/molgenis-data-security/src/main/java/org/molgenis/data/security/auth/UserMetadata.java b/molgenis-data-security/src/main/java/org/molgenis/data/security/auth/UserMetadata.java
index <HASH>..<HASH> 100644
--- a/molgenis-data-security/src/main/java/org/molgenis/data/security/auth/UserMetadata.java
+++ b/molgenis-data-security/src/main/java/org/molgenis/data/security/auth/UserMetadata.java
@@ -75,7 +75,8 @@ public class UserMetadata extends SystemEntityType {
         .setLabel("Username")
         .setUnique(true)
         .setNillable(false)
-        .setReadOnly(true);
+        .setReadOnly(true)
+        .setValidationExpression("$('" + USERNAME + "').matches(/^[\\S].+[\\S]$/).value()");
     addAttribute(PASSWORD)
         .setLabel("Password")
         .setDescription("This is the hashed password, enter a new plaintext password to update.")
Fix #<I>: Usernames are not checked for spaces