{"record":{"id":"4d2f045ed150ab5c","repo":"kubesphere/kubesphere","slug":"invalid-mapping-method-found-s","errorCode":null,"errorMessage":"invalid mapping method found %s","messagePattern":"invalid mapping method found (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/models/auth/authenticator.go","lineNumber":105,"sourceCode":"\t\t\t\t}\n\t\t\t\tmappedUser.Annotations[fmt.Sprintf(\"%s.%s\", iamv1beta1.IdentityProviderAnnotation, providerConfig.Name)] = identity.GetUserID()\n\t\t\t\tmappedUser.Status.State = iamv1beta1.UserActive\n\t\t\t\tif identity.GetEmail() != \"\" {\n\t\t\t\t\tmappedUser.Spec.Email = identity.GetEmail()\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t})\n\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to create or update user %s, error: %v\", mappedUser.Name, err)\n\t\t\t}\n\n\t\t\tklog.V(4).Infof(\"user %s has been updated successfully, operation: %s\", mappedUser.Name, op)\n\n\t\t\treturn &authuser.DefaultInfo{Name: mappedUser.GetName()}, nil\n\t\t}\n\n\t\treturn nil, fmt.Errorf(\"invalid mapping method found %s\", providerConfig.MappingMethod)\n\t}\n\n\tif mappedUser.Status.State == iamv1beta1.UserDisabled {\n\t\treturn nil, AccountIsNotActiveError\n\t}\n\n\treturn &authuser.DefaultInfo{Name: mappedUser.GetName()}, nil\n}\n","sourceCodeStart":87,"sourceCodeEnd":114,"githubUrl":"https://github.com/kubesphere/kubesphere/blob/04a29b5c601470fa6bc2f2e92358dcb802a0d414/pkg/models/auth/authenticator.go#L87-L114","documentation":"authByIdentityProvider maps an identity from an identity provider to a KubeSphere user according to the IdentityProvider's MappingMethod (e.g. 'auto', 'lookup'). If the configured MappingMethod string is none of the supported values, the function falls through all mapping branches and returns this error. It indicates a misconfigured or unsupported mappingMethod in the IdentityProvider spec.","triggerScenarios":"A user authenticates via an OAuth/generic identity provider (oauthAuthenticator.Authenticate or passwordAuthenticator.authByProvider) and the referenced IdentityProvider resource has a mappingMethod value outside {auto, lookup} (typo like 'Auto', 'manual', or empty after CRD validation bypass).","commonSituations":"Hand-edited IdentityProvider YAML with a typo in mappingMethod; upgrading KubeSphere after a custom mapping method was removed; applying CRs via tooling that skips OpenAPI validation.","solutions":["Check kubectl get identityprovider <name> -o yaml and correct spec.mappingMethod to 'auto' or 'lookup'","Re-apply the IdentityProvider with a validated sample manifest","If a custom method is needed, extend authByIdentityProvider in pkg/models/auth/authenticator.go to support it"],"exampleFix":"// before\nmappingMethod: Auto\n// after\nmappingMethod: auto","handlingStrategy":"validation","validationCode":"const validMethods = map[string]bool{\"auto\": true, \"lookup\": true}\nif !validMethods[idp.Spec.MappingMethod] {\n  return fmt.Errorf(\"identity provider %s has unsupported mappingMethod %q\", idp.Name, idp.Spec.MappingMethod)\n}","typeGuard":null,"tryCatchPattern":"user, err := authenticate(ctx, provider, req)\nif err != nil {\n  if strings.Contains(err.Error(), \"invalid mapping method\") {\n    // fix IdentityProvider CR mappingMethod before retrying login\n  }\n  return err\n}","preventionTips":["Only set mappingMethod to 'auto' or 'lookup' in IdentityProvider CRs","Apply CRs through validation-enabled tooling (kubectl apply, not raw etcd writes)","Add a schema enum for mappingMethod in your CRD/manifests"],"tags":["auth","identity-provider","configuration"],"backgroundTag":"invalid-mapping-method","analyzedSha":"04a29b5c601470fa6bc2f2e92358dcb802a0d414","analyzedAt":"2026-09-03T18:33:15.017Z","contentChangedAt":"2026-09-03T18:33:15.017Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}