{"record":{"id":"8c26ea82853821c5","repo":"passbolt/passbolt_api","slug":"0-group-s-returned-by-your-directory-are-invalid-and-will-be","errorCode":null,"errorMessage":"{0} group(s) returned by your directory are invalid and will be ignored during synchronization","messagePattern":"(.+?) group\\(s\\) returned by your directory are invalid and will be ignored during synchronization","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/PassboltEe/DirectorySync/src/Command/TestCommand.php","lineNumber":206,"sourceCode":"        if (count($data['users'])) {\n            $io->hr();\n            $io->err(\n                __(\n                    '{0} users returned by your directory are invalid and will be ignored during synchronization',\n                    count($data['users'])\n                )\n            );\n            $io->err(__('bin/cake directory_sync test --verbose for more details'));\n            $io->hr();\n            foreach ($data['users'] as $user) {\n                $io->verbose(__('Error: ') . $user->getErrorsAsString());\n                $io->verbose(json_encode($user->toArray(), JSON_PRETTY_PRINT));\n            }\n        }\n\n        if (count($data['groups'])) {\n            $io->hr();\n            $io->err(\n                __(\n                    '{0} group(s) returned by your directory are invalid and will be ignored during synchronization',\n                    count($data['groups'])\n                )\n            );\n            $io->hr();\n            foreach ($data['groups'] as $group) {\n                $io->verbose(__('Error: ') . $group->getErrorsAsString());\n                $io->verbose(json_encode($group->toArray(), JSON_PRETTY_PRINT));\n            }\n        }\n    }\n}\n","sourceCodeStart":188,"sourceCodeEnd":220,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/DirectorySync/src/Command/TestCommand.php#L188-L220","documentation":"TestCommand::displayInvalidEntries warns that N groups returned by the directory failed entity validation and will be ignored during synchronization. Like the user variant, the directory was reachable but group entities didn't pass validation rules (e.g. empty group name from a bad name attribute mapping).","triggerScenarios":"`bin/cake passbolt directory_sync test` where $directoryResults->getGroups() contains entities failing validation, typically groups with missing or malformed names/DNs.","commonSituations":"Group name attribute mapping wrong (e.g. mapped to cn vs dn incorrectly), security-principal search scope including non-group objects, groups with empty names, or name length/charset rule violations.","solutions":["Re-run with --verbose; note that group detail output follows the same pattern as users to inspect errors.","Fix the group name attribute mapping in directory sync configuration.","Clean up invalid groups in the directory or narrow the group search filter/base DN.","Validate the search filter returns only group objects (objectClass filter)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"$invalidGroups = array_filter($groups, fn($g) => (bool)$g->getErrors());\nif ($invalidGroups) { echo count($invalidGroups) . \" invalid groups will be skipped\\n\"; }","typeGuard":"foreach ($data['groups'] as $group) {\n    if (!($group instanceof \\Passbolt\\DirectorySync\\Model\\Entity\\DirectoryEntry)) { continue; }\n    if ($group->getErrors()) { /* handle */ }\n}","tryCatchPattern":null,"preventionTips":["Verify group name attribute mapping (e.g. cn)","Filter LDAP search to group objectClasses only","Pre-validate group names against passbolt length/charset rules","Narrow the group base DN"],"tags":["cli","ldap","directory-sync","groups","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}