{"record":{"id":"0c14fac515200ac6","repo":"apereo/cas","slug":"could-not-locate-an-ldap-entry-for-filter-and-ba","errorCode":null,"errorMessage":"Could not locate an LDAP entry for [filter] and base DN [baseDn]","messagePattern":"Could not locate an LDAP entry for \\[filter\\] and base DN \\[baseDn\\]","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authentication/LdapPasswordSynchronizationAuthenticationPostProcessor.java","lineNumber":71,"sourceCode":"\n            if (LdapUtils.containsResultEntry(response)) {\n                val dn = response.getEntry().getDn();\n                LOGGER.debug(\"Updating account password for [{}]\", dn);\n\n                val operation = new ModifyOperation(searchFactory.getConnectionFactory());\n                val mod = new AttributeModification(AttributeModification.Type.REPLACE, getLdapPasswordAttribute(credential));\n                val updateResponse = operation.execute(new ModifyRequest(dn, mod));\n                LOGGER.trace(\"Result code [{}], message: [{}]\", response.getResultCode(), response.getDiagnosticMessage());\n                val result = updateResponse.getResultCode() == ResultCode.SUCCESS;\n                if (!result) {\n                    val message = String.format(\"Could not update the LDAP entry's password for %s and base DN %s: %s\",\n                        filter.format(), ldapProperties.getBaseDn(), updateResponse.getDiagnosticMessage());\n                    throw new IllegalStateException(message);\n                }\n                LOGGER.info(\"Updated the LDAP entry's password for [{}] and base DN [{}]\", filter.format(), ldapProperties.getBaseDn());\n            } else {\n                val message = String.format(\"Could not locate an LDAP entry for %s and base DN %s\", filter.format(), ldapProperties.getBaseDn());\n                throw new IllegalStateException(message);\n            }\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n            if (ldapProperties.isPasswordSynchronizationFailureFatal()) {\n                throw new AuthenticationException(e);\n            }\n\n        }\n    }\n\n    @Override\n    public boolean supports(final Credential credential) {\n        return credential instanceof UsernamePasswordCredential;\n    }\n\n    protected LdapAttribute getLdapPasswordAttribute(final UsernamePasswordCredential credential) {\n        if (\"unicodePwd\".equals(ldapProperties.getPasswordAttribute())) {\n            return new UnicodePwdAttribute(credential.toPassword());","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authentication/LdapPasswordSynchronizationAuthenticationPostProcessor.java#L53-L89","documentation":"Before modifying the password, the post-processor searches LDAP for the user entry using the configured filter and base DN. If the search returns no entry, it throws an IllegalStateException: the account whose password was to be synchronized does not exist in that subtree.","triggerScenarios":"process() runs after authentication but the search filter (e.g. (uid={0}) or (mail={user})) matches nothing under ldapProperties.getBaseDn() — wrong base DN, wrong filter attribute, user lives in a different OU, or the bind DN cannot see that subtree.","commonSituations":"Base DN missing an OU segment (ou=people forgotten); authenticated user authenticated via another handler (different backend) but the LDAP sync handler still runs; case/attribute mismatch between CAS principal id and directory uid.","solutions":["Verify the search filter matches a real entry: run ldapsearch with the same filter and base DN using the configured bind credentials","Correct cas.authn.ldap[x].base-dn to the OU containing user entries","Align the user filter attribute with the actual naming/principal attribute (uid vs sAMAccountName vs cn)","Skip password synchronization for users not in this directory (restrict the handler's applicable authentication sources)","Log the resolved DN and filter to confirm what was actually searched"],"exampleFix":"// before\n// base-dn=dc=example,dc=org\n// user-filter=(uid={user})\n// after\n// base-dn=ou=people,dc=example,dc=org\n// user-filter=(sAMAccountName={user})","handlingStrategy":"validation","validationCode":"// before enabling sync, confirm the user resolves\nSearchResult entry = LdapUtils.getLdapEntry(ldapProperties, filter);\nif (entry == null) throw new IllegalStateException(\"No LDAP entry for filter \" + filter);\nString dn = entry.getDn();","typeGuard":null,"tryCatchPattern":"try {\n    postProcessor.process(authentication);\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"Could not locate an LDAP entry\")) {\n        // skip sync for users outside this directory / alert on filter-base mismatch\n    }\n} else if (e instanceof AuthenticationException ae) { /* fatal path */ }","preventionTips":["Validate base-dn and user-filter with ldapsearch before production","Confirm the authentication source that produced the principal actually lives in this directory","Keep filter attribute consistent with the directory naming attribute","Log filter.format() and base DN on failure for quick diagnosis"],"tags":["ldap","empty-result","configuration"],"backgroundTag":"ldap-entry-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}