{"record":{"id":"810d0b323e1464e9","repo":"opf/openproject","slug":"ldap-error-could-not-authenticate-at-the-ldap-ser","errorCode":null,"errorMessage":"LDAP-Error: Could not authenticate at the LDAP-Server.","messagePattern":"LDAP-Error: Could not authenticate at the LDAP-Server\\.","errorType":"exception","errorClass":"LdapAuthSource::Error","httpStatus":null,"severity":"error","filePath":"app/models/ldap_auth_source.rb","lineNumber":184,"sourceCode":"                    attributes: search_attributes) do |entry|\n      attrs = get_user_attributes_from_ldap_entry(entry)\n      Rails.logger.debug { \"DN found for #{login}: #{attrs[:dn]}\" }\n    end\n\n    attrs\n  rescue Net::LDAP::Error => e\n    raise LdapAuthSource::Error, \"LdapError: #{e.message}\"\n  end\n\n  # Open and return a system connection\n  def with_connection\n    yield initialize_ldap_con(account, account_password)\n  end\n\n  # test the connection to the LDAP\n  def test_connection\n    unless authenticate_dn(account, account_password)\n      raise LdapAuthSource::Error,\n            I18n.t(\"ldap_auth_sources.ldap_error\", error_message: I18n.t(\"ldap_auth_sources.ldap_auth_failed\"))\n    end\n  rescue Net::LDAP::Error => e\n    raise LdapAuthSource::Error,\n          I18n.t(\"ldap_auth_sources.ldap_error\", error_message: e.to_s)\n  end\n\n  def get_user_attributes_from_ldap_entry(entry)\n    base_attributes = {\n      dn: entry.dn,\n      ldap_auth_source_id: id\n    }\n\n    base_attributes.merge mapped_attributes(entry)\n  end\n\n  def mapped_attributes(entry)\n    %i[login firstname lastname mail admin].each_with_object({}) do |key, hash|","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/opf/openproject/blob/d9742c43f3424c34b63550f8c03f201fe5c3040c/app/models/ldap_auth_source.rb#L166-L202","documentation":"LdapAuthSource#test_connection binds to the LDAP server with the configured system account (account/account_password) via authenticate_dn. A failed bind — not a network failure — raises LdapAuthSource::Error with the ldap_error template wrapping the fixed ldap_auth_failed text. The server was reached; the DN/password pair was rejected or the account is locked.","triggerScenarios":"Clicking 'Test connection' on an LDAP auth source whose Bind DN or account password is wrong, the bind account's password expired, or the account got locked out by repeated failed attempts.","commonSituations":"Password rotation on the service account not reflected in OpenProject; Bind DN typed with the wrong DN structure (missing DC components); Active Directory disabling the account; copy-paste artifacts like trailing spaces or smart quotes in the password.","solutions":["Re-enter the exact Bind DN and account password in the LDAP auth source form and test again.","Verify the credentials independently: ldapsearch -x -H <host> -D '<bind dn>' -W.","Check server-side for a locked/expired bind account and unlock/extend it."],"exampleFix":"# before\nauth_source.test_connection\n\n# after (distinguish bind failure from network failure)\nbegin\n  auth_source.test_connection\nrescue LdapAuthSource::Error => e\n  raise e.message.include?(I18n.t('ldap_auth_sources.ldap_auth_failed')) ? 'Bind rejected: check DN/password' : e\nend","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  ldap_auth_source.test_connection\nrescue LdapAuthSource::Error => e\n  raise BindFailed, 'check bind DN/password' if e.message.include?(I18n.t('ldap_auth_sources.ldap_auth_failed'))\n  raise\nend","preventionTips":["Run the auth source test connection after every credential rotation.","Verify bind credentials with ldapsearch before configuring OpenProject.","Use a service account with a non-expiring password for bind operations."],"tags":["ldap","authentication","bind-dn","configuration"],"backgroundTag":"ldap-bind-failed","analyzedSha":"d9742c43f3424c34b63550f8c03f201fe5c3040c","analyzedAt":"2026-08-21T14:40:06.829Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}