RocketChat/Rocket.Chat · error · Error

Please verify your mapping for LDAP X RocketChat ABAC Attrib

Error message

Please verify your mapping for LDAP X RocketChat ABAC Attributes. The structure is invalid, the structure should be an object like: {key: LdapAttribute, value: RocketChatAbacAttribute}

What it means

Thrown by Manager.validateLDAPABACAttributeMap when the parsed LDAP_ABAC_AttributeMap JSON has any entry whose key OR value is not a string. Unlike team mapping, values are single strings (not arrays). Empty/null/empty-keys JSON returns early. Plain Error.

Source

Thrown at apps/meteor/ee/server/lib/ldap/Manager.ts:200

			return;
		}

		const mappedAttributes = this.parseJson(json);

		// attributes are { key: value } with key being the ldap attribute and value being the abac attribute in rocketchat
		// both strings
		// There's no need for the attribute to exist in rocketchat, we just add whatever the admin wants to map

		if (!mappedAttributes || Object.keys(mappedAttributes).length === 0) {
			return;
		}

		const validStructureMapping = Object.entries(mappedAttributes).every(
			([key, value]) => typeof key === 'string' && typeof value === 'string',
		);

		if (!validStructureMapping) {
			throw new Error(
				'Please verify your mapping for LDAP X RocketChat ABAC Attributes. The structure is invalid, the structure should be an object like: {key: LdapAttribute, value: RocketChatAbacAttribute}',
			);
		}
	}

	public static async syncAvatarAndAbacAttributes(): Promise<void> {
		const syncAvatars = settings.get('LDAP_Background_Sync_Avatars');
		const syncAbac = settings.get('LDAP_Background_Sync_ABAC_Attributes') && License.hasModule('abac') && settings.get('ABAC_Enabled');
		const abacMapping = syncAbac && this.parseJson(settings.get('LDAP_ABAC_AttributeMap'));

		if (!syncAvatars && !syncAbac) {
			return;
		}

		try {
			const ldap = new LDAPConnection();
			await ldap.connect();

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Format LDAP_ABAC_AttributeMap as {"<ldapAttribute>": "<rocketChatAbacAttribute>"} with both sides strings.
  2. Ensure the ABAC license module is present if you intend to use ABAC; otherwise disable ABAC_Enabled.
  3. Validate JSON shape in a parser before saving.

Example fix

// before (throws — value is a number)
{"department": 5}

// after
{"department": "department"}
Defensive patterns

Strategy: validation

Validate before calling

function validateAbacMap(json: string): void {
  const obj = JSON.parse(json);
  const ok = Object.entries(obj).every(([k, v]) => typeof k === 'string' && typeof v === 'string');
  if (!ok) throw new Error('LDAP ABAC map must be Record<string, string>');
}

Type guard

const isAbacMap = (o: unknown): o is Record<string, string> =>
  typeof o === 'object' && o !== null && Object.entries(o).every(([k, v]) => typeof k === 'string' && typeof v === 'string');

Try / catch

try { Manager.validateLDAPABACAttributeMap(json); } catch (e) {
  if (e instanceof Error && e.message.includes('LDAP X RocketChat ABAC Attributes')) { /* fix values to strings and re-save */ } else throw e;
}

Prevention

When it happens

Trigger: Admin saves LDAP_ABAC_AttributeMap with a numeric/object/array value, or a non-string key; ABAC sync is enabled (LDAP_Background_Sync_ABAC_Attributes + ABAC_Enabled + License 'abac' module) so the mapping is actually consumed.

Common situations: Mapping written as {"department": 5} (number) or {"ldap-cn": ["attr"]} (array instead of string); copy-paste from the teams-mapping example; ABAC enabled for the first time against a stale mapping.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/6b429b73a58fae16. Report an issue: GitHub.