{"record":{"id":"8ed9803c1c3008f2","repo":"n8n-io/n8n","slug":"forgotpassword-ldapuserpasswordresetunavailable","errorCode":null,"errorMessage":"forgotPassword.ldapUserPasswordResetUnavailable","messagePattern":"forgotPassword\\.ldapUserPasswordResetUnavailable","errorType":"exception","errorClass":"UnprocessableRequestError","httpStatus":422,"severity":"warning","filePath":"packages/cli/src/controllers/password-reset.controller.ts","lineNumber":124,"sourceCode":"\t\t\t\tthis.logger.debug(\n\t\t\t\t\t`Request to send password reset email failed because login is handled by ${currentAuthenticationMethod}`,\n\t\t\t\t);\n\t\t\t\tthrow new ForbiddenError(\n\t\t\t\t\t`Login is handled by ${currentAuthenticationMethod}. Please contact your Identity Provider to reset your password.`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst ldapIdentity = user.authIdentities?.find((i) => i.providerType === 'ldap');\n\t\t\tif (!user.password || (ldapIdentity && user.disabled)) {\n\t\t\t\tthis.logger.debug(\n\t\t\t\t\t'Request to send password reset email failed because no user was found for the provided email',\n\t\t\t\t\t{ invalidEmail: email },\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (this.license.isLdapEnabled() && ldapIdentity) {\n\t\t\t\tthrow new UnprocessableRequestError('forgotPassword.ldapUserPasswordResetUnavailable');\n\t\t\t}\n\n\t\t\tconst url = this.authService.generatePasswordResetUrl(user);\n\n\t\t\tconst { id, firstName } = user;\n\t\t\ttry {\n\t\t\t\tawait this.mailer.passwordReset({\n\t\t\t\t\temail,\n\t\t\t\t\tfirstName,\n\t\t\t\t\tpasswordResetUrl: url,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tthis.eventService.emit('email-failed', {\n\t\t\t\t\tuser,\n\t\t\t\t\tmessageType: 'Reset password',\n\t\t\t\t\tpublicApi: false,\n\t\t\t\t});\n\t\t\t\tif (error instanceof Error) {","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/password-reset.controller.ts#L106-L142","documentation":"n8n refuses to send a password-reset email for a user whose identity is managed by LDAP. When the instance license has LDAP enabled (license.isLdapEnabled()) and the resolved user has an authIdentity with providerType 'ldap', the request is rejected with 422 UnprocessableRequestError because the user's credentials live in the directory server, not n8n's local store.","triggerScenarios":"POST to the forgot-password endpoint with an email that resolves to a user who has an 'ldap' authIdentity, while the instance is licensed for and running with LDAP enabled. The lookup path also short-circuits earlier (returns silently) when the user has no password or is disabled, so this throw only fires for an active LDAP user with an LDAP identity.","commonSituations":"SSO/LDAP deployments where some users are provisioned through the directory; an admin or user clicks 'Forgot password' in the UI for an account that is authenticated against LDAP rather than locally.","solutions":["Reset the user's password in the LDAP/Active Directory server, since n8n does not own it.","Confirm the user is expected to be LDAP-managed; if they should be local, remove the ldap authIdentity or re-provision.","If LDAP is not actually in use, disable the LDAP license feature so isLdapEnabled() returns false."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before calling forgot-password, check whether the target user is LDAP-managed.\n// Pseudo caller-side check (requires a user lookup the caller already has):\nfunction isLdapManaged(user) {\n  return Boolean(user?.authIdentities?.some((i) => i.providerType === 'ldap'));\n}\n// if (isLdapManaged(user)) { route to directory password reset, do NOT call /forgot-password }","typeGuard":"function isLdapManaged(user) {\n  return Boolean(\n    user &&\n    Array.isArray(user.authIdentities) &&\n    user.authIdentities.some((i) => i && i.providerType === 'ldap'),\n  );\n}","tryCatchPattern":"try {\n  await api.post('/forgot-password', { email });\n} catch (e) {\n  if (e.status === 422 && /ldapUserPasswordResetUnavailable/.test(e.message)) {\n    // direct user to LDAP/directory reset instead of retrying\n  } else { throw e; }\n}","preventionTips":["Detect LDAP-managed users in the UI before offering the 'Forgot password' link.","Document that LDAP users must reset via the directory server, not n8n."],"tags":["ldap","sso","auth","password-reset","license"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}