SonarSource/sonarqube · error · LdapException

Unable to retrieve details for user %s: No user or group map

Error message

Unable to retrieve details for user %s: No user or group mapping found.

What it means

Before performing any group lookup, checkPrerequisites verifies that at least one user mapping and one group mapping were configured. If either sonar.authenticator.ldap.user.* or group.* mappings are empty, it throws this LdapException because group retrieval is impossible without mappings. This is a configuration-validation error, not a directory error.

Source

Thrown at server/sonar-auth-ldap/src/main/java/org/sonar/auth/ldap/DefaultLdapGroupsProvider.java:84

      SearchResult searchResult = searchUserGroups(username, serverKey);
      if (searchResult != null) {
        try {
          NamingEnumeration<SearchResult> result = groupMappings
            .get(serverKey)
            .createSearch(contextFactories.get(serverKey), searchResult).find();
          groups.addAll(mapGroups(serverKey, result));
        } catch (NamingException e) {
          LOG.debug(e.getMessage(), e);
          throw new LdapException(format("Unable to retrieve groups for user %s in server with key <%s>", username, serverKey), e);
        }
      }
    }
    return groups;
  }

  private void checkPrerequisites(String username) {
    if (userMappings.isEmpty() || groupMappings.isEmpty()) {
      throw new LdapException(format("Unable to retrieve details for user %s: No user or group mapping found.", username));
    }
  }

  private SearchResult searchUserGroups(String username, String serverKey) {
    try {
      LOG.debug("Requesting groups for user {}", username);
      return userMappings.get(serverKey).createSearch(contextFactories.get(serverKey), username)
        .returns(groupMappings.get(serverKey).getRequiredUserAttributes())
        .findUnique();
    } catch (NamingException e) {
      // just in case if Sonar silently swallowed exception
      LOG.debug(e.getMessage(), e);
      throw new LdapException(format("Unable to retrieve groups for user %s in server with key <%s>", username, serverKey), e);
    }
  }

  /**
   * Map all the groups.

View on GitHub (pinned to 184c821202)

Solutions

Configure the group mapping properties: sonar.authenticator.ldap.group.baseDn, group.objectClass, group.idAttribute (and user.* mappings).
Check the sonar.authenticator.ldap value: 'sonarqube' enables both user and group mappings.
Verify property spellings against sonar-auth-ldap documentation.

Example fix

// before: only URL configured, no group mapping
sonar.authenticator.ldap.url: ldap://ldap.example.com
// after: add user+group mappings
sonar.authenticator.ldap.user.baseDn: ou=users,dc=example,dc=org
sonar.authenticator.ldap.group.baseDn: ou=groups,dc=example,dc=org
sonar.authenticator.ldap.group.objectClass: groupOfNames
sonar.authenticator.ldap.group.idAttribute: cn

Defensive patterns

Strategy: validation

Validate before calling

// validate mapping config before relying on group retrieval
if (!config.hasKey("sonar.authenticator.ldap.user.baseDn") ||
    !config.hasKey("sonar.authenticator.ldap.group.baseDn")) {
  throw new IllegalStateException("LDAP user and group mappings must both be configured");
}

Try / catch

try {
  groups = provider.getGroups(username);
} catch (LdapException e) {
  if (e.getMessage().contains("No user or group mapping found")) {
    LOG.error("LDAP group mapping not configured — check sonar.authenticator.ldap.group.* properties");
  }
  throw e;
}

Prevention

Use sonar.authenticator.ldap=sonarqube so both user and group mappings initialize.
Keep a config checklist: url, user.*, group.* for each environment.
Run SonarQube with debug logging once after config changes.

When it happens

Trigger: Calling getGroups (via doGetGroups) when the LdapSettingsManager produced empty userMappings or groupMappings — i.e. no sonar.authenticator.ldap.user.* or sonar.authenticator.ldap.group.* properties were set in configuration.

Common situations: sonar.authenticator.ldap set to a value other than 'sonarqube' causing mapping initialization to be skipped; fresh install where only ldap.url was configured without group settings; mis-typed property prefixes (e.g. sonar.authenticator.ldao.group.baseDn).

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/35cad9fb2203a921. Report an issue: GitHub.