{"record":{"id":"954ad049d3deb370","repo":"RocketChat/Rocket.Chat","slug":"failed-to-generate-unique-identifier-for-ldap-entr","errorCode":null,"errorMessage":"Failed to generate unique identifier for ldap entry","messagePattern":"Failed to generate unique identifier for ldap entry","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"apps/meteor/server/lib/ldap/Manager.ts","lineNumber":424,"sourceCode":"\t\t\tuserSearchField = userSearchField.replace(/\\s/g, '').split(',');\n\t\t} else {\n\t\t\tuserSearchField = [];\n\t\t}\n\n\t\tuniqueIdentifierField = uniqueIdentifierField.concat(userSearchField);\n\t\tif (!uniqueIdentifierField.length) {\n\t\t\tuniqueIdentifierField.push('dn');\n\t\t}\n\n\t\tconst key = uniqueIdentifierField.find((field) => !_.isEmpty(ldapUser._raw[field]));\n\t\tif (key) {\n\t\t\treturn {\n\t\t\t\tattribute: key,\n\t\t\t\tvalue: ldapUser._raw[key].toString('hex'),\n\t\t\t};\n\t\t}\n\n\t\tconnLogger.warn('Failed to generate unique identifier for ldap entry');\n\t\tconnLogger.debug(ldapUser);\n\t}\n\n\tprivate static getLdapName(ldapUser: ILDAPEntry): string | undefined {\n\t\tconst nameAttributes = getLDAPConditionalSetting<string | undefined>('LDAP_Name_Field');\n\t\treturn getLdapDynamicValue(ldapUser, nameAttributes);\n\t}\n\n\tprivate static getLdapExtension(ldapUser: ILDAPEntry): string | undefined {\n\t\tconst extensionAttribute = settings.get<string>('LDAP_Extension_Field');\n\t\tif (!extensionAttribute) {\n\t\t\treturn;\n\t\t}\n\n\t\treturn getLdapString(ldapUser, extensionAttribute);\n\t}\n\n\tprivate static getLdapEmails(ldapUser: ILDAPEntry, username?: string): string[] {","sourceCodeStart":406,"sourceCodeEnd":442,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/ldap/Manager.ts#L406-L442","documentation":"When converting an LDAP entry, Rocket.Chat computes a unique identifier from the attributes listed in LDAP_Unique_Identifier_Field plus LDAP_User_Search_Field, falling back to 'dn'. This warning means none of those attributes — including the dn fallback — existed in the entry's raw buffer map (ldapUser._raw), so no stable unique ID could be derived and user matching for that entry is skipped.","triggerScenarios":"LDAP login or data sync encounters an entry where every configured unique-id/search attribute is missing from _raw: misspelled attribute names in settings, attributes not returned by the server's search (not in the filter or attribute list), or an exotic entry (referral/root object) with no dn buffer.","commonSituations":"Using AD attribute names on OpenLDAP ('objectGUID' vs 'entryUUID'); attribute names with wrong casing or spaces (settings are split on ',' after stripping spaces); the directory server not returning binary attributes unless explicitly requested; custom LDAP schemas with renamed attributes.","solutions":["Check spelling of LDAP_Unique_Identifier_Field and LDAP_User_Search_Field against real attribute names — 'objectGUID' (AD) or 'entryUUID' (OpenLDAP) are the usual stable choices","Test the exact search with ldapsearch to confirm the configured attributes come back on the entries","If unsure, clear both fields so the built-in 'dn' fallback is used","Read the connLogger.debug(ldapUser) line right after the warning — it dumps the failing entry and shows which attributes were actually returned"],"exampleFix":"// before (Admin > LDAP)\nLDAP_Unique_Identifier_Field: 'objectGUID, customld' // typo\n\n// after\nLDAP_Unique_Identifier_Field: 'objectGUID'","handlingStrategy":"validation","validationCode":"const configuredFields = [\n  ...(settings.get<string>('LDAP_Unique_Identifier_Field')?.replace(/\\s/g, '').split(',') ?? []),\n  ...(getLDAPConditionalSetting<string>('LDAP_User_Search_Field')?.replace(/\\s/g, '').split(',') ?? []),\n  'dn',\n].filter(Boolean);\n\nconst hasStableId = (entry: ILDAPEntry): boolean =>\n  configuredFields.some((field) => !_.isEmpty(entry._raw?.[field]));\n\nif (!hasStableId(ldapUser)) {\n  // skip entry, alert admin: no attribute to key this user on\n}","typeGuard":"const hasRawAttribute = (entry: ILDAPEntry, field: string): entry is ILDAPEntry & { _raw: Record<string, Buffer> } =>\n  Boolean(entry?._raw) && !_.isEmpty(entry._raw[field]);","tryCatchPattern":null,"preventionTips":["Prefer 'objectGUID' (AD) or 'entryUUID' (OpenLDAP) as the unique identifier attribute","Verify with ldapsearch that every synced entry returns the configured attributes","Leave the unique-identifier fields empty to use the 'dn' fallback rather than guessing attribute names"],"tags":["ldap","sync","attribute-mapping","unique-id"],"backgroundTag":"ldap-attribute-not-found","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}