{"record":{"id":"757f5ea52365068a","repo":"goharbor/harbor","slug":"the-ldap-group-dn-is-invalid","errorCode":null,"errorMessage":"the LDAP group DN is invalid","messagePattern":"the LDAP group DN is invalid","errorType":"exception","errorClass":"ErrInvalidLDAPGroupDN","httpStatus":null,"severity":"warning","filePath":"src/core/auth/authenticator.go","lineNumber":47,"sourceCode":"\t\"github.com/goharbor/harbor/src/pkg/usergroup/model\"\n)\n\n// 1.5 seconds\nconst frozenTime time.Duration = 1500 * time.Millisecond\n\nvar lock = NewUserLock(frozenTime)\n\n// ErrorUserNotExist ...\nvar ErrorUserNotExist = errors.New(\"user does not exist\")\n\n// ErrorGroupNotExist ...\nvar ErrorGroupNotExist = errors.New(\"group does not exist\")\n\n// ErrDuplicateLDAPGroup ...\nvar ErrDuplicateLDAPGroup = errors.New(\"a LDAP user group with same DN already exist\")\n\n// ErrInvalidLDAPGroupDN ...\nvar ErrInvalidLDAPGroupDN = errors.New(\"the LDAP group DN is invalid\")\n\n// ErrNotSupported ...\nvar ErrNotSupported = errors.New(\"not supported\")\n\n// ErrAuth is the type of error to indicate a failed authentication due to user's error.\ntype ErrAuth struct {\n\tdetails string\n}\n\n// Error ...\nfunc (ea ErrAuth) Error() string {\n\treturn fmt.Sprintf(\"Failed to authenticate user, due to error '%s'\", ea.details)\n}\n\n// NewErrAuth ...\nfunc NewErrAuth(msg string) ErrAuth {\n\treturn ErrAuth{details: msg}\n}","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/core/auth/authenticator.go#L29-L65","documentation":"Sentinel ErrInvalidLDAPGroupDN is returned by the LDAP auth helper (ldap.go:274 and 307) when a group DN fails validation - the string is not a structurally valid LDAP distinguished name or the search on it cannot be built. It is a data-format rejection, not a connectivity error.","triggerScenarios":"POST/PUT /api/v2.0/usergroups (LDAP type) with a malformed DN such as plain 'devs' instead of 'cn=devs,ou=groups,dc=example,dc=com'; trailing spaces or broken attribute components in the DN.","commonSituations":"Admins entering only the group CN instead of the full DN copy/paste with invisible characters, smart quotes, or wrong attribute order (dc/cn/ou).","solutions":["Submit a full comma-separated DN: cn=<group>,ou=...,dc=...","Trim whitespace and check each component has a valid attribute prefix (cn, ou, dc, o)","Validate with ldapsearch -b '<DN>' against the directory before configuring Harbor"],"exampleFix":"// before\n\"ldap_group_dn\": \"dev-team\"\n\n// after\n\"ldap_group_dn\": \"cn=dev-team,ou=groups,dc=example,dc=com\"","handlingStrategy":"validation","validationCode":"var dnPattern = regexp.MustCompile(`^(?:CN|OU|DC)=[^,]+(?:,(?:CN|OU|DC|O)=[^,]+)*$`)\nfunc validDN(s string) bool {\n    s = strings.TrimSpace(s)\n    return s != \"\" && dnPattern.MatchString(s) && !strings.Contains(s, \"  \")\n}\nif !validDN(dn) { return errors.New(\"refusing to submit malformed DN\") }","typeGuard":"func isInvalidLDAPGroupDN(err error) bool { return errors.Is(err, auth.ErrInvalidLDAPGroupDN) }","tryCatchPattern":"if errors.Is(err, auth.ErrInvalidLDAPGroupDN) {\n    return fmt.Errorf(\"group DN %q is malformed: expected cn=...,ou=...,dc=...\", dn)\n}","preventionTips":["Validate DN shape in the UI/API client before submit","Test DNs with ldapsearch before entering them in Harbor","Trim pasted input to kill stray whitespace"],"tags":["harbor","ldap","dn","validation","usergroup"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}