RocketChat/Rocket.Chat · error · Error

error-invalid-user

error-invalid-user

Error message

error-invalid-user

What it means

Thrown by the POST /api/v1/ldap.testConnection endpoint when this.userId is falsy. Although the route declares authRequired: true and permissionsRequired: ['test-admin-options'], this manual check is a defensive guard inside the action handler. Reaching it means the authentication layer resolved no user ID for the request — the caller is not recognized as a logged-in user.

Source

Thrown at apps/meteor/server/api/v1/ldap.ts:34

	},
	required: ['message', 'success'] as const,
	additionalProperties: false,
};

API.v1.post(
	'ldap.testConnection',
	{
		authRequired: true,
		permissionsRequired: ['test-admin-options'],
		response: {
			200: ajv.compile<{ message: string; success: true }>(messageResponseSchema),
			401: validateUnauthorizedErrorResponse,
			403: validateForbiddenErrorResponse,
		},
	},
	async function action() {
		if (!this.userId) {
			throw new Error('error-invalid-user');
		}

		if (settings.get<boolean>('LDAP_Enable') !== true) {
			throw new Error('LDAP_disabled');
		}

		try {
			await LDAP.testConnection();
		} catch (err) {
			SystemLogger.error({ err });
			throw new Error('Connection_failed');
		}

		return API.v1.success({
			message: 'LDAP_Connection_successful' as const,
		});
	},
);

View on GitHub (pinned to f9d3ec372b)

Solutions

1. Re-authenticate via POST /api/v1/login (or use a valid personal access token) and pass both X-Auth-Token and X-User-Id headers.
2. Verify the token is still valid by calling GET /api/v1/me — if it returns 401, generate a new token.
3. Ensure the user account still exists and has the 'test-admin-options' permission.

Example fix

// before
curl -X POST https://rocketchat.example/api/v1/ldap.testConnection
// after
curl -X POST https://rocketchat.example/api/v1/ldap.testConnection \
  -H "X-Auth-Token: ${AUTH_TOKEN}" \
  -H "X-User-Id: ${USER_ID}"

// Before calling ldap.testConnection, verify the session is valid
async function ensureAuthenticated(api, token, userId) {
  const res = await fetch(`${api}/api/v1/me`, {
    headers: { 'X-Auth-Token': token, 'X-User-Id': userId }
  });
  return res.ok;
}

if (!(await ensureAuthenticated(baseUrl, authToken, userId))) {
  throw new Error('Session expired — re-authenticate before calling ldap.testConnection');
}

try {
  await callLdapTestConnection();
} catch (e) {
  if (e.reason === 'error-invalid-user' || e.error === 'error-invalid-user') {
    // re-authenticate and retry once
    await login();
    return callLdapTestConnection();
  }
  throw e;
}

When it happens

Trigger: Calling POST /api/v1/ldap.testConnection without X-Auth-Token / X-User-Id headers, with an expired or revoked token, or with a token whose user account was deleted.

Common situations: API session expired between login and the LDAP test call; script or CI job using a stale token from a previous run; personal access token revoked by an admin; calling from a different server instance than where the token was issued.

Related errors

• error-parameter-required
• error-invalid-user-id
• Invalid integration id or token provided.
• Invalid Api parameter provided, it must be a valid IApi obje
• Could not open popup

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/1bbf38602a0db65c. Report an issue: GitHub.