{"record":{"id":"58f38015d5e6742c","repo":"RocketChat/Rocket.Chat","slug":"ldap-search-failed","errorCode":"LDAP_search_failed","errorMessage":"LDAP_search_failed","messagePattern":"LDAP_search_failed","errorType":"exception","errorClass":"Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/server/api/v1/ldap.ts","lineNumber":79,"sourceCode":"\t\t\t200: ajv.compile<{ message: string; success: true }>(messageResponseSchema),\n\t\t\t401: validateUnauthorizedErrorResponse,\n\t\t\t403: validateForbiddenErrorResponse,\n\t\t},\n\t},\n\tasync function action() {\n\t\tif (!this.userId) {\n\t\t\tthrow new Error('error-invalid-user');\n\t\t}\n\n\t\tif (settings.get<boolean>('LDAP_Enable') !== true) {\n\t\t\tthrow new Error('LDAP_disabled');\n\t\t}\n\n\t\ttry {\n\t\t\tawait LDAP.testSearch(this.bodyParams.username);\n\t\t} catch (err) {\n\t\t\tSystemLogger.error({ err });\n\t\t\tthrow new Error('LDAP_search_failed');\n\t\t}\n\n\t\treturn API.v1.success({\n\t\t\tmessage: 'LDAP_User_Found' as const,\n\t\t});\n\t},\n);\n","sourceCodeStart":61,"sourceCodeEnd":87,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/api/v1/ldap.ts#L61-L87","documentation":"Thrown when LDAP.testSearch(this.bodyParams.username) from @rocket.chat/core-services throws. The underlying exception is logged to SystemLogger but only the generic 'LDAP_search_failed' message reaches the caller. The search itself failed — the connection may have succeeded but the query (search base, filter, or user lookup) returned an error.","triggerScenarios":"Incorrect LDAP search base DN or filter configuration, the directory server dropped the connection mid-search, the bind account lacks search permissions, or the username does not match the configured filter syntax.","commonSituations":"Search Base DN points to the wrong OU; the username attribute in the filter doesn't match the directory schema (e.g., uid vs sAMAccountName); bind account has insufficient ACLs to search the tree; LDAP_Enable is true but other LDAP settings are still defaults.","solutions":["Check SystemLogger for the underlying error — it will reveal whether the issue is a connection, filter, or permission problem.","Verify the LDAP Search Base DN (LDAP_Search_Base) is correct for the directory structure.","Verify the LDAP Filter (LDAP_Filter) uses the correct attribute name for the directory (uid, sAMAccountName, mail, etc.).","Confirm the bind account has search/read permissions on the target OU.","Test the same search externally with ldapsearch to isolate the issue."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-validate the username format against the LDAP filter before calling testSearch\n// The filter typically looks like (uid={0}) or (sAMAccountName={0})\n// Ensure the username doesn't contain characters that break the filter\nfunction isValidLdapUsername(username) {\n  return typeof username === 'string' && username.length > 0 && /^[a-zA-Z0-9._@-]+$/.test(username);\n}\nif (!isValidLdapUsername(username)) {\n  throw new Error('Invalid username format for LDAP search');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await callLdapTestSearch(username);\n} catch (e) {\n  if (e.error === 'LDAP_search_failed') {\n    console.error('LDAP search failed — check SystemLogger for details.');\n    console.error('Verify: Search Base DN, filter attribute, bind permissions, user existence.');\n    return;\n  }\n  throw e;\n}","preventionTips":["Check SystemLogger for the underlying LDAP error after a search failure.","Verify LDAP Search Base DN and filter are correctly configured before testing searches.","Test the equivalent search externally with ldapsearch to isolate configuration issues."],"tags":["ldap","search","configuration"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}