RocketChat/Rocket.Chat · error · Error

LDAP_disabled

Error message

LDAP_disabled

What it means

Thrown by POST ldap.syncNow when the LDAP_Enable setting is not exactly true. The sync endpoint refuses to run because no LDAP server is configured/active, even though the user is authorized. The check is strict (=== true), so any falsy, missing, or stringly-typed value triggers it.

Source

Thrown at apps/meteor/ee/server/api/ldap.ts:40

		forceTwoFactorAuthenticationForNonEnterprise: true,
		twoFactorRequired: true,
		response: {
			200: ldapSyncNowResponseSchema,
			400: validateBadRequestErrorResponse,
			401: validateUnauthorizedErrorResponse,
		},
	},
	async function action() {
		if (!this.userId) {
			throw new Error('error-invalid-user');
		}

		if (!(await hasPermissionAsync(this.user, 'sync-auth-services-users'))) {
			throw new Error('error-not-authorized');
		}

		if (settings.get('LDAP_Enable') !== true) {
			throw new Error('LDAP_disabled');
		}

		await LDAPEnterprise.sync();
		await LDAPEnterprise.syncAvatarAndAbacAttributes();

		return API.v1.success({
			message: 'Sync_in_progress' as const,
		});
	},
);

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Enable LDAP in Administration > LDAP > Enable (set LDAP_Enable = true) and save.
  2. Verify the setting value with the settings API: GET /v1/settings/LDAP_Enable should return true.
  3. Configure LDAP connection details (host, port, base DN) before enabling, so sync is meaningful.
  4. Re-enable LDAP if it was disabled for maintenance.

Example fix

// before: sync attempted while disabled
POST /v1/ldap.syncNow   // LDAP_Enable = false

// after: enable then sync
PUT /v1/settings/LDAP_Enable  { "value": true }
POST /v1/ldap.syncNow
Defensive patterns

Strategy: validation

Validate before calling

// Read the setting before triggering sync
const res = await fetch('/api/v1/settings/LDAP_Enable', { headers: authHeaders() });
const { value } = await res.json();
if (value !== true) {
  throw new Error('LDAP is disabled; enable it in Administration > LDAP first.');
}

Type guard

function isLdapEnabled(value: unknown): value is true {
  return value === true;
}

Try / catch

try {
  await api.post('ldap.syncNow', {});
} catch (e) {
  if (e.message === 'LDAP_disabled') {
    promptEnableLdap();
    return;
  }
  throw e;
}

Prevention

When it happens

Trigger: Calling POST /v1/ldap.syncNow while LDAP_Enable is false, unset, or the setting was never toggled on after configuration. Also fires after LDAP was disabled for maintenance.

Common situations: Fresh install where LDAP was never enabled; admin disabled LDAP during a directory migration; setting reset to default after a config restore; boolean stored as a string by a migration.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/b529f2b6e2eccf3e. Report an issue: GitHub.