AlistGo/alist · error

cannot get username from ldap provider

Error message

cannot get username from ldap provider

What it means

Returned by ladpRegister when the username extracted from the LDAP bind result is an empty string. During LDAP auto-registration the server maps the authenticated LDAP user to a local model.User; a usable username is mandatory because it becomes the local login identity, so an empty mapping aborts registration before db.CreateUser.

Source

Thrown at server/handles/ldap_login.go:126

			common.ErrorResp(c, err, 400)
			loginCache.Set(ip, count+1)
			return
		}
	}

	// generate token
	token, err := common.GenerateToken(user)
	if err != nil {
		common.ErrorResp(c, err, 400, true)
		return
	}
	common.SuccessResp(c, gin.H{"token": token})
	loginCache.Del(ip)
}

func ladpRegister(username string) (*model.User, error) {
	if username == "" {
		return nil, errors.New("cannot get username from ldap provider")
	}
	user := &model.User{
		ID:         0,
		Username:   username,
		Password:   random.String(16),
		Permission: int32(setting.GetInt(conf.LdapDefaultPermission, 0)),
		BasePath:   setting.GetStr(conf.LdapDefaultDir),
		Role:       nil,
		Disabled:   false,
	}
	if err := db.CreateUser(user); err != nil {
		return nil, err
	}
	return user, nil
}

func dial(ldapServer string) (*ldap.Conn, error) {
	var tlsEnabled bool = false

View on GitHub (pinned to 843d9dc814)

Solutions

1. Check the LDAP username-attribute setting and set it to an attribute every target user entry actually has (uid / sAMAccountName)
2. Inspect the user entry with ldapsearch using the same filter and base DN to confirm which attribute carries the login name
3. Pre-create the local user (or disable LDAP auto-register) until the attribute mapping is fixed

Example fix

// before: ldap settings
username_attribute: "cn"   # empty for some entries
// after
username_attribute: "uid"

// Before enabling LDAP auto-register, verify the attribute exists for sample users
// ldapsearch -x -H <url> -D <bind> -w <pw> -b <baseDN> <filter> <usernameAttribute>

user, err := ladpRegister(username)
if err != nil && strings.Contains(err.Error(), "cannot get username from ldap provider") {
    // config issue: username attribute mapping is wrong or empty in the entry — fix LDAP settings
}

When it happens

Trigger: Successful LDAP authentication where the configured username attribute is absent from the user entry or maps to an empty value (e.g. attribute 'uid' vs 'sAMAccountName' mismatch, or 'cn' empty).

Common situations: OpenLDAP deployments where accounts key on 'uid' but the setting points at 'cn' or 'mail'; AD trees where 'sAMAccountName' is fine but the filter matches computer objects with different attributes; LDAP user attribute mappings changed after a directory schema migration.

Related errors

• api_key is empty
• cookie is empty
• invalid auth_type
• empty token
• cannot get username from SSO provider

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/fff4556fa90769ef. Report an issue: GitHub.