{"record":{"id":"45e3de722b5a0910","repo":"theonedev/onedev","slug":"unknown-account","errorCode":null,"errorMessage":"Unknown account","messagePattern":"Unknown account","errorType":"validation","errorClass":"UnknownAccountException","httpStatus":null,"severity":"warning","filePath":"server-plugin/server-plugin-authenticator-ldap/src/main/java/io/onedev/server/plugin/authenticator/ldap/LdapAuthenticator.java","lineNumber":255,"sourceCode":"        try {\n            logger.debug(\"Binding to ldap url '\" + getLdapUrl() + \"'...\");\n            try {\n            \tctx = new InitialDirContext(ldapEnv);\n            } catch (AuthenticationException e) {\n        \t\tthrow new RuntimeException(\"Cannot bind to ldap server '\" + getLdapUrl() + \"': \" + e.getMessage());\n            }\n\n\t\t\tNamingEnumeration<SearchResult> results = null;\n\t\t\tfor (var userSearchBase: getUserSearchBases()) {\n\t\t\t\t results = ctx.search(new CompositeName().add(userSearchBase), \n\t\t\t\t\t\tuserSearchFilter, searchControls);\n\t\t\t\t if (results.hasMore())\n\t\t\t\t\t break;\n\t\t\t}\n\t\t\tif (results == null)\n\t\t\t\tthrow new ExplicitException(\"No user search base specified\");\n\t\t\tif (!results.hasMore())\n\t\t\t\tthrow new UnknownAccountException(\"Unknown account\");\n            \n            SearchResult searchResult = results.next();\n            String userDN = searchResult.getNameInNamespace();\n            if (!searchResult.isRelative()) {\n            \tStringBuilder builder = new StringBuilder();\n                builder.append(StringUtils.substringBefore(searchResult.getName(), \"//\"));\n                builder.append(\"//\");\n                builder.append(StringUtils.substringBefore(\n                \t\tStringUtils.substringAfter(searchResult.getName(), \"//\"), \"/\"));\n                \n                ldapEnv.put(Context.PROVIDER_URL, builder.toString());\n                logger.debug(\"Binding to referral ldap url '\" + builder.toString() + \"'...\");\n                referralCtx = new InitialDirContext(ldapEnv);\n            }\n            if (userDN.startsWith(\"ldap\")) {\n            \tuserDN = StringUtils.substringAfter(userDN, \"//\");\n            \tuserDN = StringUtils.substringAfter(userDN, \"/\");\n            }","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-authenticator-ldap/src/main/java/io/onedev/server/plugin/authenticator/ldap/LdapAuthenticator.java#L237-L273","documentation":"After searching every configured user search base with the user search filter, OneDev found no matching LDAP entries. It throws UnknownAccountException('Unknown account') to signal the login name does not correspond to any directory user visible under the configured bases and filter.","triggerScenarios":"ctx.search over all userSearchBases with userSearchFilter returns no entries for the entered username — either the user does not exist in the directory, or the search bases/filter exclude them.","commonSituations":"User exists in a different OU than the configured search base; userSearchFilter (e.g. '(uid={username})') uses an attribute that's empty in the directory (sAMAccountName vs uid); AD users in a domain not covered by the base; typo in username.","solutions":["Verify the username with ldapsearch against the same base and filter, e.g. ldapsearch -H ldaps://host -D 'manager dn' -W -b 'ou=People,dc=example,dc=com' '(uid=jdoe)'.","Widen the user search base to the OU or domain root that actually contains the user.","Check the user search filter attribute matches your directory schema (use sAMAccountName for Active Directory, uid for OpenLDAP).","Confirm the manager DN binding has read access to the OU containing the user."],"exampleFix":"// before (AD): userSearchFilter = \"(uid={username})\"\n// after  (AD): userSearchFilter = \"(sAMAccountName={username})\"","handlingStrategy":"fallback","validationCode":"// Pre-check with ldapsearch before blaming the app:\n// ldapsearch -H ldaps://host -D '<manager dn>' -W -b '<search base>' '(uid=<user>)' dn","typeGuard":null,"tryCatchPattern":"try {\n    auth.authenticate(token);\n} catch (UnknownAccountException e) {\n    // distinguish 'user not in directory' from 'wrong password' for the user-facing message\n}","preventionTips":["Match the search filter attribute to the directory schema (sAMAccountName vs uid)","Set the search base high enough to cover all user OUs","Verify manager binding can read the whole subtree","Test with ldapsearch whenever directory layout changes"],"tags":["ldap","authentication","user-not-found"],"backgroundTag":"user-not-found","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}