{"record":{"id":"0da756a3279c28a9","repo":"RocketChat/Rocket.Chat","slug":"failed-to-convert-some-role-names-to-ids","errorCode":null,"errorMessage":"Failed to convert some role names to ids","messagePattern":"Failed to convert some role names to ids","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"apps/meteor/server/lib/saml/lib/SAML.ts","lineNumber":42,"sourceCode":"\nconst showErrorMessage = function (res: ServerResponse, err: string): void {\n\tres.writeHead(200, {\n\t\t'Content-Type': 'text/html',\n\t});\n\tconst content = `Sorry, an annoying error occured
${escapeHTML(err)}
`;\n\tres.end(content, 'utf-8');\n};\n\nconst convertRoleNamesToIds = async (roleNamesOrIds: string[]): Promise => {\n\tconst normalizedRoleNamesOrIds = roleNamesOrIds.map((role) => role.trim()).filter((role) => role.length > 0);\n\tif (!normalizedRoleNamesOrIds.length) {\n\t\tthrow new Error(`No valid role names or ids provided for conversion: ${roleNamesOrIds.join(', ')}`);\n\t}\n\n\tconst roles = (await Roles.findInIdsOrNames(normalizedRoleNamesOrIds).toArray()).map((role) => role._id);\n\n\tif (roles.length !== normalizedRoleNamesOrIds.length) {\n\t\tSystemLogger.warn({\n\t\t\tmsg: 'Failed to convert some role names to ids',\n\t\t\troles: normalizedRoleNamesOrIds,\n\t\t});\n\t}\n\n\tif (!roles.length) {\n\t\tthrow new Error(`We should have at least one existing role to create the user: ${normalizedRoleNamesOrIds.join(', ')}`);\n\t}\n\n\treturn roles;\n};\n\nexport class SAML {\n\tpublic static async processRequest(\n\t\treq: IIncomingMessage,\n\t\tres: ServerResponse,\n\t\tservice: IServiceProviderOptions,\n\t\tsamlObject: ISAMLAction,","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/2a7de457074cbb4d4373fbd9a4e5bea292c9c764/apps/meteor/server/lib/saml/lib/SAML.ts#L24-L60","documentation":"During SAML login, configured role names/ids are resolved to internal role ids via Roles.findInIdsOrNames after trimming. If some configured roles match nothing in the Roles collection, this warning lists them; if none resolve at all, the function throws ('We should have at least one existing role...') and login fails.","triggerScenarios":"SAML settings (role attribute mapping, default roles on user creation) reference roles that do not exist in Administration > Roles — deleted, renamed, misspelled, or referenced by name where only the id differs.","commonSituations":"An admin deletes/renames a role after SAML mapping was configured; IdP sends role values that were never created in Rocket.Chat; environment drift between staging (role exists) and production (role missing).","solutions":["Compare the warned role list against Administration > Roles and correct the names/ids in the SAML provider settings","Create the missing roles or map the IdP attribute to existing ones","Clean up the mapping list — trailing commas or stray separators produce empty/invalid entries","If login fails with 'We should have at least one existing role', ensure at least one mapped role exists as a valid fallback"],"exampleFix":"// before (SAML role mapping)\nroles: ['admin', 'suport-team'] // 'suport-team' does not exist\n\n// after\nroles: ['admin', 'support-team'] // matches role in Administration > Roles","handlingStrategy":"validation","validationCode":"const normalized = roleNamesOrIds.map((r) => r.trim()).filter(Boolean);\nconst existing = await Roles.findInIdsOrNames(normalized).toArray();\nconst existingIds = new Set(existing.map((r) => r._id));\nconst existingNames = new Set(existing.map((r) => r.name?.toLowerCase()).filter(Boolean));\nconst missing = normalized.filter((r) => !existingIds.has(r) && !existingNames.has(r.toLowerCase()));\nif (missing.length) {\n throw new Error(`SAML role mapping references unknown roles: ${missing.join(', ')}`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate SAML role mappings against Administration > Roles whenever roles change","Prefer stable role ids over display names in mappings","Keep at least one guaranteed-existing fallback role so login never hard-fails"],"tags":["saml","roles","mapping","login"],"backgroundTag":"unknown-role-mapping","analyzedSha":"2a7de457074cbb4d4373fbd9a4e5bea292c9c764","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}