RocketChat/Rocket.Chat · error · Error

Please verify your mapping for LDAP X RocketChat Teams. The

Error message

Please verify your mapping for LDAP X RocketChat Teams. The structure is invalid, the structure should be an object like: {key: LdapTeam, value: [An array of rocket.chat teams]}

What it means

Thrown by Manager.validateLDAPTeamMap when the parsed LDAP_Team_Map JSON is an object whose values are not all non-empty arrays of strings. The validator first runs mustBeAnArrayOfStrings on each value (Object.values(mappedTeams).every(...)). Plain Error. Empty/null JSON returns early and does not throw; the failure is specifically a shape mismatch.

Source

Thrown at apps/meteor/ee/server/lib/ldap/Manager.ts:174

		}
	}

	public static validateLDAPTeamsMappingChanges(json: string): void {
		if (!json) {
			return;
		}

		const mustBeAnArrayOfStrings = (array: Array<string>): boolean =>
			Boolean(Array.isArray(array) && array.length && array.every((item) => typeof item === 'string'));
		const mappedTeams = this.parseJson(json);
		if (!mappedTeams) {
			return;
		}

		const mappedRocketChatTeams = Object.values(mappedTeams);
		const validStructureMapping = mappedRocketChatTeams.every(mustBeAnArrayOfStrings);
		if (!validStructureMapping) {
			throw new Error(
				'Please verify your mapping for LDAP X RocketChat Teams. The structure is invalid, the structure should be an object like: {key: LdapTeam, value: [An array of rocket.chat teams]}',
			);
		}
	}

	public static validateLDAPABACAttributeMap(json: string): void {
		if (!json) {
			return;
		}

		const mappedAttributes = this.parseJson(json);

		// attributes are { key: value } with key being the ldap attribute and value being the abac attribute in rocketchat
		// both strings
		// There's no need for the attribute to exist in rocketchat, we just add whatever the admin wants to map

		if (!mappedAttributes || Object.keys(mappedAttributes).length === 0) {
			return;

View on GitHub (pinned to f9d3ec372b)

Solutions

Format the mapping as {"<ldapTeamKey>": ["<rocketChatTeamId>", ...]} with every value a non-empty string array.
Validate the JSON in a linter/JSON parser before saving; ensure arrays even for single-element mappings.
Re-save the corrected value and trigger an LDAP sync to confirm.

Example fix

// before (throws — value is a string, not an array)
{"cn=devs": "rocket-devs"}

// after
{"cn=devs": ["rocket-devs"]}

Defensive patterns

Strategy: validation

Validate before calling

function validateTeamMap(json: string): void {
  const obj = JSON.parse(json);
  const ok = Object.values(obj).every((v) => Array.isArray(v) && v.length > 0 && v.every((i) => typeof i === 'string'));
  if (!ok) throw new Error('LDAP team map must be Record<string, string[]>');
}

Type guard

const isTeamMap = (o: unknown): o is Record<string, string[]> =>
  typeof o === 'object' && o !== null && Object.values(o).every((v) => Array.isArray(v) && v.every((i) => typeof i === 'string'));

Try / catch

try { Manager.validateLDAPTeamMap(json); } catch (e) {
  if (e instanceof Error && e.message.includes('LDAP X RocketChat Teams')) { /* fix JSON shape and re-save */ } else throw e;
}

Prevention

Always wrap single team names in an array.
Lint LDAP mapping JSON in CI for admin config exports.
Document the exact {key: string[]} shape next to the setting.

When it happens

Trigger: Admin saves LDAP_Team_Map (or LDAP_Group_Filter_Mapping) with a value that is a single string instead of an array, an empty array, an array containing non-strings, or a non-array value.

Common situations: Copy-pasted mapping from docs that used the wrong shape; manual JSON edit that dropped the array brackets; mapping one team to a single string '{"ldap-grp": "rocket-team"}' instead of '{"ldap-grp": ["rocket-team"]}'.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/d4ed1ccb08ec2274. Report an issue: GitHub.