{"record":{"id":"6b429b73a58fae16","repo":"RocketChat/Rocket.Chat","slug":"please-verify-your-mapping-for-ldap-x-rocketchat-a","errorCode":null,"errorMessage":"Please verify your mapping for LDAP X RocketChat ABAC Attributes. The structure is invalid, the structure should be an object like: {key: LdapAttribute, value: RocketChatAbacAttribute}","messagePattern":"Please verify your mapping for LDAP X RocketChat ABAC Attributes\\. The structure is invalid, the structure should be an object like: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/ee/server/lib/ldap/Manager.ts","lineNumber":200,"sourceCode":"\t\t\treturn;\n\t\t}\n\n\t\tconst mappedAttributes = this.parseJson(json);\n\n\t\t// attributes are { key: value } with key being the ldap attribute and value being the abac attribute in rocketchat\n\t\t// both strings\n\t\t// There's no need for the attribute to exist in rocketchat, we just add whatever the admin wants to map\n\n\t\tif (!mappedAttributes || Object.keys(mappedAttributes).length === 0) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst validStructureMapping = Object.entries(mappedAttributes).every(\n\t\t\t([key, value]) => typeof key === 'string' && typeof value === 'string',\n\t\t);\n\n\t\tif (!validStructureMapping) {\n\t\t\tthrow new Error(\n\t\t\t\t'Please verify your mapping for LDAP X RocketChat ABAC Attributes. The structure is invalid, the structure should be an object like: {key: LdapAttribute, value: RocketChatAbacAttribute}',\n\t\t\t);\n\t\t}\n\t}\n\n\tpublic static async syncAvatarAndAbacAttributes(): Promise<void> {\n\t\tconst syncAvatars = settings.get('LDAP_Background_Sync_Avatars');\n\t\tconst syncAbac = settings.get('LDAP_Background_Sync_ABAC_Attributes') && License.hasModule('abac') && settings.get('ABAC_Enabled');\n\t\tconst abacMapping = syncAbac && this.parseJson(settings.get('LDAP_ABAC_AttributeMap'));\n\n\t\tif (!syncAvatars && !syncAbac) {\n\t\t\treturn;\n\t\t}\n\n\t\ttry {\n\t\t\tconst ldap = new LDAPConnection();\n\t\t\tawait ldap.connect();\n","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/ee/server/lib/ldap/Manager.ts#L182-L218","documentation":"Thrown by Manager.validateLDAPABACAttributeMap when the parsed LDAP_ABAC_AttributeMap JSON has any entry whose key OR value is not a string. Unlike team mapping, values are single strings (not arrays). Empty/null/empty-keys JSON returns early. Plain Error.","triggerScenarios":"Admin saves LDAP_ABAC_AttributeMap with a numeric/object/array value, or a non-string key; ABAC sync is enabled (LDAP_Background_Sync_ABAC_Attributes + ABAC_Enabled + License 'abac' module) so the mapping is actually consumed.","commonSituations":"Mapping written as {\"department\": 5} (number) or {\"ldap-cn\": [\"attr\"]} (array instead of string); copy-paste from the teams-mapping example; ABAC enabled for the first time against a stale mapping.","solutions":["Format LDAP_ABAC_AttributeMap as {\"<ldapAttribute>\": \"<rocketChatAbacAttribute>\"} with both sides strings.","Ensure the ABAC license module is present if you intend to use ABAC; otherwise disable ABAC_Enabled.","Validate JSON shape in a parser before saving."],"exampleFix":"// before (throws — value is a number)\n{\"department\": 5}\n\n// after\n{\"department\": \"department\"}","handlingStrategy":"validation","validationCode":"function validateAbacMap(json: string): void {\n  const obj = JSON.parse(json);\n  const ok = Object.entries(obj).every(([k, v]) => typeof k === 'string' && typeof v === 'string');\n  if (!ok) throw new Error('LDAP ABAC map must be Record<string, string>');\n}","typeGuard":"const isAbacMap = (o: unknown): o is Record<string, string> =>\n  typeof o === 'object' && o !== null && Object.entries(o).every(([k, v]) => typeof k === 'string' && typeof v === 'string');","tryCatchPattern":"try { Manager.validateLDAPABACAttributeMap(json); } catch (e) {\n  if (e instanceof Error && e.message.includes('LDAP X RocketChat ABAC Attributes')) { /* fix values to strings and re-save */ } else throw e;\n}","preventionTips":["Keep ABAC mapping values as single strings, not arrays or numbers.","Verify the ABAC license module is present before enabling ABAC_Enabled."],"tags":["ldap","abac","config","mapping","enterprise"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}